Package: backuppc
Version: 3.2.1-2
Severity: grave
Tags: patch security
Justification: user security hole
User: ubuntu-de...@lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch
Dear Maintainer,
In Ubuntu, the attached patch was applied to achieve the following:
* SECURITY UPDATE: XSS in CGI/RestoreFile.pm
- lib/BackupPC/CGI/RestoreFile.pm: update to escape share and backup
number
- CVE-2011-5081
I developed the attached patch and forwarded it upstream. I have not
heard back yet, but the patch is obvious and works here. Thanks for
considering the patch.
-- System Information:
Debian Release: wheezy/sid
APT prefers precise-updates
APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500,
'precise')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-24-generic (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -u backuppc-3.2.1/debian/changelog backuppc-3.2.1/debian/changelog
only in patch2:
unchanged:
--- backuppc-3.2.1.orig/lib/BackupPC/CGI/RestoreFile.pm
+++ backuppc-3.2.1/lib/BackupPC/CGI/RestoreFile.pm
@@ -154,12 +154,12 @@
my $a = $view->fileAttrib($num, $share, $dir);
if ( $dir =~ m{(^|/)\.\.(/|$)} || !defined($a) ) {
$dir = decode_utf8($dir);
- ErrorExit("Can't restore bad file ${EscHTML($dir)} ($num, $share)");
+ ErrorExit("Can't restore bad file ${EscHTML($dir)} (${EscHTML($num)}, ${EscHTML($share)})");
}
my $f = BackupPC::FileZIO->open($a->{fullPath}, 0, $a->{compress});
if ( !defined($f) ) {
my $fullPath = decode_utf8($a->{fullPath});
- ErrorExit("Unable to open file ${EscHTML($fullPath)} ($num, $share)");
+ ErrorExit("Unable to open file ${EscHTML($fullPath)} (${EscHTML($num)}, ${EscHTML($share)})");
}
my $data;
if ( !$skipHardLink && $a->{type} == BPC_FTYPE_HARDLINK ) {
