VERY CRITICAL: Security Patch for mj_wwwusr

"Marc G. Fournier" <[email protected]> Fri, 4 Feb 2011 19:10:47 -0400 (AST)

Newsgroups	gmane.mail.majordomo.majordomo2.devel
Message-ID	<[email protected]>

Someone just pointed out to me that something like:

mj_wwwusr?passw=&list=GLOBAL&user=&func=help&extra=/../../../../../../../../etc/rc.conf

Will allow you to read files from the file system ... the following simple 
three lines *appears* to eliminate that ability ... I couldn't find a 
similar issue in mj_wwwadm, only mj_wwwusr, but if anyone has found 
something, or has a better fix, please post ...

*** mj_wwwusr.or        Fri Feb  4 19:06:34 2011
--- mj_wwwusr   Fri Feb  4 19:08:21 2011
***************
*** 191,196 ****
--- 191,199 ----
                                          '' : $user });
   $extra = $cgi->param('extra');
   $extra = '' unless (defined $extra);
+ if($extra =~ /\.\./) {
+   $extra = '';
+ }

   $subs = { $mj->standard_subs('GLOBAL'),
             'CGIDATA'  => $cgidata,




----
Marc G. Fournier                        Hub.Org Hosting Solutions S.A.
[email protected]                                     http://www.hub.org

Yahoo:yscrappy    Skype: hub.org    ICQ:7615664    MSN:[email protected]