1 files changed, 85 insertions, 0 deletions
diff --git a/metadata/glsa/glsa-200812-20.xml b/metadata/glsa/glsa-200812-20.xml
new file mode 100644
index 000000000000..1ee47fdc91a6
--- /dev/null
+++ b/metadata/glsa/glsa-200812-20.xml
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
+<glsa id="200812-20">
+  <title>phpCollab: Multiple vulnerabilities</title>
+  <synopsis>
+    Multiple vulnerabilities have been discovered in phpCollab allowing for
+    remote injection of shell commands, PHP code and SQL statements.
+  </synopsis>
+  <product type="ebuild">phpcollab</product>
+  <announced>2008-12-21</announced>
+  <revised count="01">2008-12-21</revised>
+  <bug>235052</bug>
+  <access>remote</access>
+  <affected>
+    <package name="www-apps/phpcollab" auto="yes" arch="*">
+      <vulnerable range="le">2.5_rc3</vulnerable>
+    </package>
+  </affected>
+  <background>
+    <p>
+    phpCollab is a web-enabled groupware and project management software
+    written in PHP. It uses SQL-based database backends.
+    </p>
+  </background>
+  <description>
+    <p>
+    Multiple vulnerabilities have been found in phpCollab:
+    </p>
+    <ul>
+    <li>rgod reported that data sent to general/sendpassword.php via the
+    loginForm parameter is not properly sanitized before being used in an
+    SQL statement (CVE-2006-1495).</li>
+    <li>Christian Hoffmann of Gentoo
+    Security discovered multiple vulnerabilities where input is
+    insufficiently sanitized before being used in an SQL statement, for
+    instance in general/login.php via the loginForm parameter.
+    (CVE-2008-4303).</li>
+    <li>Christian Hoffmann also found out that the
+    variable $SSL_CLIENT_CERT in general/login.php is not properly
+    sanitized before being used in a shell command. (CVE-2008-4304).</li>
+    <li>User-supplied data to installation/setup.php is not checked before
+    being written to include/settings.php which is executed later. This
+    issue was reported by Christian Hoffmann as well (CVE-2008-4305).</li>
+    </ul>
+  </description>
+  <impact type="high">
+    <p>
+    These vulnerabilities enable remote attackers to execute arbitrary SQL
+    statements and PHP code. NOTE: Some of the SQL injection
+    vulnerabilities require the php.ini option "magic_quotes_gpc" to be
+    disabled. Furthermore, an attacker might be able to execute arbitrary
+    shell commands if "register_globals" is enabled, "magic_quotes_gpc" is
+    disabled, the PHP OpenSSL extension is not installed or loaded and the
+    file "installation/setup.php" has not been deleted after installation.
+    </p>
+  </impact>
+  <workaround>
+    <p>
+    There is no known workaround at this time.
+    </p>
+  </workaround>
+  <resolution>
+    <p>
+    phpCollab has been removed from the Portage tree. We recommend that
+    users unmerge phpCollab:
+    </p>
+    <code>
+    # emerge --unmerge "www-apps/phpcollab"</code>
+  </resolution>
+  <references>
+    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1495">CVE-2006-1495</uri>
+    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4303">CVE-2008-4303</uri>
+    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4304">CVE-2008-4304</uri>
+    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4305">CVE-2008-4305</uri>
+  </references>
+  <metadata tag="requester" timestamp="2008-10-19T20:05:40Z">
+    rbu
+  </metadata>
+  <metadata tag="submitter" timestamp="2008-12-07T13:16:45Z">
+    a3li
+  </metadata>
+  <metadata tag="bugReady" timestamp="2008-12-10T16:51:12Z">
+    a3li
+  </metadata>
+</glsa>