Nessus Plugin #17665
Plugin Index
Note: This file has been created from a
downloaded version of the Nessus Plugins
from
http://www.nessus.org/.
Therefore, the information here can be outdated.
[GLSA-200503-35] Smarty: Template vulnerability
- Family:
- Gentoo Local Security Checks
- Category:
- infos
- Copyright:
- (C) 2005 Michel Arboi
- Summary:
- Smarty: Template vulnerability
- Version:
- $Revision: 1.1 $
- Cve_id:
- -
- Bugtraq_id:
- -
- Xrefs:
- GLSA:200503-35
- Description:
- The remote host is affected by the vulnerability described in GLSA-200503-35
(Smarty: Template vulnerability)
A vulnerability has been discovered within the regex_replace
modifier of the Smarty templates when allowing access to untrusted
users.
Impact
This issue may allow a remote attacker to bypass the "template
security" feature of Smarty, and execute arbitrary PHP code.
Workaround
Do not grant template access to untrusted users.
References:
http://smarty.php.net/misc/NEWS
Solution:
All Smarty users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-php/smarty-2.6.8"
Risk factor : High
Generiert am 27.04.2005 um 18:49:54 Uhr.