Bug#893804: jessie-pu: package adminer/3.3.3-1+deb8u1
Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian.org@packages.debian.org
Usertags: pu
Dear stable release manager,
Please consider adminer (3.3.3-1+deb8u1) for jessie:
adminer (3.3.3-1+deb8u1) jessie; urgency=high
* CVE-2018-7667: Adminer allowed unauthenticated connections to be initiated
to arbitrary systems and ports which coul bypass external firewalls to
identify internal hosts and/or perform port scanning of other servers.
(Closes: #893668)
The full diff is attached.
Regards,
--
,''`.
: :' : Chris Lamb
`. `'` lamby@debian.org / chris-lamb.co.uk
`-
commit 05a84a7afd8c8e059f9e08a9502417fa5f79e63d
Author: Chris Lamb <lamby@debian.org>
Date: Thu Mar 22 10:56:21 2018 -0400
CVE-2018-7667
diff --git a/debian/changelog b/debian/changelog
index 9e044c6..d878f1e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+adminer (3.3.3-1+deb8u1) jessie; urgency=high
+
+ * CVE-2018-7667: Adminer allowed unauthenticated connections to be initiated
+ to arbitrary systems and ports which coul bypass external firewalls to
+ identify internal hosts and/or perform port scanning of other servers.
+ (Closes: #893668)
+
+ -- Chris Lamb <lamby@debian.org> Tue, 20 Mar 2018 22:40:06 -0400
+
adminer (3.3.3-1) unstable; urgency=low
* Initial release (Closes: #658861)
diff --git a/debian/patches/CVE-2018-7667.patch b/debian/patches/CVE-2018-7667.patch
new file mode 100644
index 0000000..1d445a2
--- /dev/null
+++ b/debian/patches/CVE-2018-7667.patch
@@ -0,0 +1,13 @@
+--- pkg-adminer.orig/adminer/include/auth.inc.php
++++ pkg-adminer/adminer/include/auth.inc.php
+@@ -90,6 +90,10 @@ if (isset($_GET["username"])) {
+ page_footer("auth");
+ exit;
+ }
++ list($host, $port) = explode(":", SERVER, 2);
++ if (is_numeric($port) && $port < 1024) {
++ auth_error('Connecting to privileged ports is not allowed.');
++ }
+ $connection = connect();
+ }
+ if (is_string($connection) || !$adminer->login($_GET["username"], get_session("pwds"))) {
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..e4d99c3
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+CVE-2018-7667.patch
Reply to: