Package: mantis Version: 1.1.6+dfsg-2lenny4 Severity: critical Tags: security patch upstream fixed-upstream
The MantisBT project was notified by Gjoko Krstic of Zero Science Lab (gj...@zeroscience.mk) of multiple vulnerabilities affecting MantisBT <1.2.4. The two following advisories have been released explaining the vulnerabilities in greater detail: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4983.php http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4984.php As one of these vulnerabilities allows the reading of arbitrary files from the file system we are treating this issue with critical severity. Please note that this issue only affects users who have not removed the "admin" directory from their MantisBT installation. We recommend, instruct and warn users to remove this directory after installation however it is clear that many users ignore these warnings. I have requested CVE numbers via oss-sec (awaiting list moderation). As Debian is using MantisBT 1.1.x you will need to apply the following patch to resolve the issue in this older version of MantisBT: http://git.mantisbt.org/?p=mantisbt.git;a=commitdiff_plain;h=2641fdc60d2032ae1586338d6416e1eadabd7590 We have also released MantisBT 1.2.4 which resolves the issue for users of our stable 1.2.x branch. The bug report tracking this issue upstream at MantisBT: http://www.mantisbt.org/bugs/view.php?id=12607 If there are any questions or concerns please feel free to contact me.
signature.asc
Description: This is a digitally signed message part
