[interchange-cvs] interchange - racke modified WHATSNEW
interchange-cvs at icdevgroup.org
interchange-cvs at icdevgroup.org
Mon Mar 29 04:33:51 EST 2004
User: racke
Date: 2004-03-29 09:33:51 GMT
Modified: . Tag: STABLE_5_0-branch WHATSNEW
Log:
added latest security patch, added a new security section
Revision Changes Path
No revision
No revision
2.178.2.6 +16 -3 interchange/WHATSNEW
rev 2.178.2.6, prev_rev 2.178.2.5
Index: WHATSNEW
===================================================================
RCS file: /anon_cvs/repository/interchange/WHATSNEW,v
retrieving revision 2.178.2.5
retrieving revision 2.178.2.6
diff -u -r2.178.2.5 -r2.178.2.6
--- WHATSNEW 26 Mar 2004 14:38:45 -0000 2.178.2.5
+++ WHATSNEW 29 Mar 2004 09:33:50 -0000 2.178.2.6
@@ -6,10 +6,20 @@
------------------------------------------------------------------------------
-Interchange 5.0.1 released 2004-03-26.
+Interchange 5.0.1 released 2004-03-29.
-Core
-----
+Security
+--------
+
+* Plug a security hole which allows an attacker to expose arbitrary variable
+ contents by using an URL like
+ http://shop.example.com/cgi-bin/store/__SQLUSER__.
+
+ All Interchange applications using the standard "missing" special page
+ from the demo catalog or a similar one are vulnerable to this attack.
+ The attacker may learn the SQL access information for your Interchange
+ application and use this information to read and manipulate sensitive
+ data.
* Disallow [ and < in page names when setting MV_PAGE and MV_PREV_PAGE
variables.
@@ -22,6 +32,9 @@
* Don't show sensitive (i.e. @Global::HideCGI) CGI variables in a dump.
This allows saving a session to disk for diagnositic purposes in case
of order failure.
+
+Core
+----
* Allow [dump no-cgi=1 no-session=1 no-env=1] to finetune dump.
More information about the interchange-cvs
mailing list