[interchange-cvs] interchange - racke modified WHATSNEW

interchange-cvs at icdevgroup.org interchange-cvs at icdevgroup.org
Mon Mar 29 04:33:51 EST 2004


User:      racke
Date:      2004-03-29 09:33:51 GMT
Modified:  .        Tag: STABLE_5_0-branch WHATSNEW
Log:
added latest security patch, added a new security section

Revision  Changes    Path
No                   revision



No                   revision



2.178.2.6 +16 -3     interchange/WHATSNEW


rev 2.178.2.6, prev_rev 2.178.2.5
Index: WHATSNEW
===================================================================
RCS file: /anon_cvs/repository/interchange/WHATSNEW,v
retrieving revision 2.178.2.5
retrieving revision 2.178.2.6
diff -u -r2.178.2.5 -r2.178.2.6
--- WHATSNEW	26 Mar 2004 14:38:45 -0000	2.178.2.5
+++ WHATSNEW	29 Mar 2004 09:33:50 -0000	2.178.2.6
@@ -6,10 +6,20 @@
 ------------------------------------------------------------------------------
 
 
-Interchange 5.0.1 released 2004-03-26.
+Interchange 5.0.1 released 2004-03-29.
 
-Core
-----
+Security
+--------
+
+* Plug a security hole which allows an attacker to expose arbitrary variable 
+  contents by using an URL like 
+  http://shop.example.com/cgi-bin/store/__SQLUSER__. 
+
+  All Interchange applications using the standard "missing" special page
+  from the demo catalog or a similar one are vulnerable to this attack.
+  The attacker may learn the SQL access information for your Interchange
+  application and use this information to read and manipulate sensitive
+  data.
 
 * Disallow [ and < in page names when setting MV_PAGE and MV_PREV_PAGE
   variables.
@@ -22,6 +32,9 @@
 * Don't show sensitive (i.e. @Global::HideCGI) CGI variables in a dump.
   This allows saving a session to disk for diagnositic purposes in case
   of order failure.
+
+Core
+----
 
 * Allow [dump no-cgi=1 no-session=1 no-env=1] to finetune dump.
 








More information about the interchange-cvs mailing list