Re: Multiple Injection Vulnerabilities in PHP PEAR::Auth Module

"Benjamin R. Ginter" <bginter@xxxxxxxxxxxx> · Wed, 22 Feb 2006 13:32:21 -0700 (MST)

Thanks for the advisory.

Just out of curiosity, is there a reason why you did not specify which 
backends are vulnerable?

Yeah, I can go dig it up (and will) but the advisory would have been far 
more useful if it included the list of vulnerable backends; end users 
could know at a glance if they _need_ to upgrade.

Thanks again,

Ben

On Tue, 21 Feb 2006, Matt Van Gundy wrote:

PRODUCT:
   PEAR::Auth Authentication Module Package
   http://pear.php.net/package/Auth

VERSIONS AFFECTED:
   All versions < 1.2.4
   1.3 series < 1.3.0r4

DESCRIPTION:
   Some of the PEAR::Auth Container back ends do not fully validate
...