Debian Security Advisory

DSA-778-1 mantis -- missing input sanitising

Date Reported:

19 Aug 2005

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 14604.
In Mitre's CVE dictionary: CVE-2005-2556, CVE-2005-2557, CVE-2005-3090.

More information:

Two security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems:

CAN-2005-2556
A remote attacker could supply a specially crafted URL to scan arbitrary ports on arbitrary hosts that may not be accessible otherwise.
CAN-2005-2557
A remote attacker was able to insert arbitrary HTML code in bug reports, hence, cross site scripting.
CAN-2005-3090
A remote attacker was able to insert arbitrary HTML code in bug reports, hence, cross site scripting.

The old stable distribution (woody) does not seem to be affected by these problems.

For the stable distribution (sarge) these problems have been fixed in version 0.19.2-4.

For the unstable distribution (sid) these problems have been fixed in version 0.19.2-4.

We recommend that you upgrade your mantis package.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Source:: http://security.debian.org/pool/updates/main/m/mantis/mantis_0.19.2-4.dsc; http://security.debian.org/pool/updates/main/m/mantis/mantis_0.19.2-4.diff.gz; http://security.debian.org/pool/updates/main/m/mantis/mantis_0.19.2.orig.tar.gz
Architecture-independent component:: http://security.debian.org/pool/updates/main/m/mantis/mantis_0.19.2-4_all.deb

MD5 checksums of the listed files are available in the original advisory.