20dfdbfd6d
----------------------------------------------------------------------------
Two exploits have been released by "rgod" for insecure Geeklog installations
and for a bug in the "mcpuk" file manager that we've been shipping as part of
FCKeditor in all previous 1.4.0 releases.
o Some of the files outside of the public_html directory were not protected
against direct execution. If Geeklog was installed such that those files
were accessible from a URL (which has always been strongly discouraged in
the installation instructions) then those files could be used to load and
execute malicious code from a remote server.
More information: So-called Geeklog "exploit" posted
In this release, we've added the missing execution prevention for all files
outside of public_html. We would still, however, suggest that you fix your
Geeklog install if the files outside of public_html are accessible from a
URL (see our FAQ for details).
o The "mcpuk" file manager that we've integrated into FCKeditor allowed the
upload of arbitrary PHP code (even if FCKeditor was disabled in Geeklog's
config.php). Depending on your webserver's configuration, it was then
possible to execute that uploaded code.
More information: Exploit for FCKeditor's mcpuk file manager
The file manager has been removed from this release. You will therefore no
longer be able to upload files, e.g. images, through FCKeditor. Future
versions of Geeklog will ship with an updated version of FCKeditor and its
included file manager.
Note: This release also includes the updated lib-trackback.php for better
protection against Trackback spam.
----------------------------------------------------------------------------
First problem dosen't related to pkgsrc.
11 lines
607 B
Text
11 lines
607 B
Text
$NetBSD: distinfo,v 1.3 2006/07/01 00:22:38 taca Exp $
|
|
|
|
SHA1 (geeklog-1.4.0sr4.tar.gz) = e7130c1295e7efda2a46b050056a83987b789f58
|
|
RMD160 (geeklog-1.4.0sr4.tar.gz) = 3f649af15ea725f04df64eae3f0b78cd12aeb75b
|
|
Size (geeklog-1.4.0sr4.tar.gz) = 3288549 bytes
|
|
SHA1 (patch-aa) = 899fef1e35fc185289a86eff950eeef42a598f89
|
|
SHA1 (patch-ab) = 8d7f4ce02880b83907104698e5a61aa5bb7f8de6
|
|
SHA1 (patch-ac) = a976a962b28a2c40db4d0ef78d4f8472d1ece5ef
|
|
SHA1 (patch-ad) = 674392480791cd99e21982ff61b81257d4e2e765
|
|
SHA1 (patch-ae) = b7e533ff938f192ac08938cff6615ece9e37bd2f
|
|
SHA1 (patch-af) = 2976c0bdb5f892521172a7e4d2e44a66ab386ef5
|