English
¢¸¢· µÚ·Î
Ãë¾àÁ¡ID 21350
À§Çèµµ 30
Æ÷Æ® 80, ...
ÇÁ·ÎÅäÄÝ TCP
ºÐ·ù CGI
»ó¼¼¼³¸í ÇØ´ç À¥ ¼­¹ö¿¡ ¼³Ä¡µÇ¾î ÀÖ´Â phpGroupWare ¹öÀü¿¡ µû¸£¸é, phpGroupWare¿¡´Â ¾ÏȣȭµÇÁö ¾ÊÀº ÄíŰ ÀÎÁõ ½Å¿ë Á¤º¸µéÀ» ³ëÃâÇÒ ¼ö ÀÖ´Â Ãë¾àÁ¡ÀÌ Á¸ÀçÇÑ´Ù.
Joseph EngoÀÇ phpGroupWare ´Â ÀüÀÚ¿ìÆí, ͏°´õ, To-Do ¸ñ·Ï°ú °°Àº ±â´ÉÀ» Æ÷ÇÔÇÏ´Â PHP ·Î Á¦ÀÛµÈ À¥ ±â¹ÝÀÇ ±×·ì¿þ¾î ½Ã½ºÅÛÀÌ´Ù. phpGroupWare ÀϺΠ¹öÀüµé¿¡´Â ¾ÏȣȭµÇÁö ¾ÊÀº ÄíŰ ÀÎÁõ ½Å¿ë Á¤º¸µéÀ» ³ëÃâÇÒ ¼ö ÀÖ´Â Ãë¾àÁ¡ÀÌ Á¸ÀçÇÏ´Â µ¥, ÀÌ´Â ¾ÖÇø®ÄÉÀ̼ÇÀÌ Çì´õ admin °ú ÆÐ½º¿öµå¸¦ ¾ÏȣȭµÇÁö ¾ÊÀº ÄíŰ·Î ¼³Á¤Çϱ⠶§¹®ÀÌ´Ù. phpGroupWareÀÇ À¥ °ü¸®°¡ ¾ÏȣȭµÈ ¸µÅ© »ó¿¡ ±¸¼ºµÇÁö ¾Ê´Â °æ¿ì, °ø°ÝÀÚµéÀº ³×Æ®¿öÅ© Æ®·¡ÇÈÀ» ½º´ÏÇÎ(sniffing)ÇÏ¿© ½±°Ô ÆÐ½º¿öµå Á¤º¸µéÀ» ȹµæÇÒ ¼ö ÀÖ´Ù. ÀÌ´Â º¸´Ù Áö´ÉÀûÀÎ ½Ã½ºÅÛ ÇØÅ·¿¡ µµ¿ò¿¡ ÀÌ¿ëµÉ ¼ö ÀÖ´Ù.

* ¾Ë¸²: ÀÌ Á¡°ËÇ׸ñÀº ÀÌ Ãë¾àÁ¡À» Á¡°ËÇϱâ À§ÇØ ÇØ´ç phpGroupWare ¹öÀü Á¤º¸¸¸À» È®ÀÎÇÑ´Ù. µû¶ó¼­ °ÅÁþ ¾ç¼º¹ÝÀÀ(False Positive)À» º¸ÀÏ ¼ö ÀÖ´Ù.

* Âü°í »çÀÌÆ®:
http://www.osvdb.org/8354

* ¿µÇâÀ» ¹Þ´Â Ç÷§Æû:
Joseph Engo: phpGroupWare 0.9.14.007, 0.9.14.006, 0.9.14.005, 0.9.14.003
Joseph Engo: phpGroupWare 0.9.16.000, 0.9.16.001
Joseph Engo: phpGroupWare 0.9.13
Joseph Engo: phpGroupWare 0.9.12
Debian Linux 2.2
Conectiva Linux 7.0, 8.0, 9.0
Linux Any version
Windows Any version
Unix Any version
ÇØ°áÃ¥ phpGroupWare ´Ù¿î·Îµå »çÀÌÆ®ÀÎ http://prdownloads.sourceforge.net/phpgroupware/ ¿¡¼­ phpGroupWareÀÇ °¡Àå ÃֽйöÀü(0.9.16.002 ¶Ç´Â ±× ÀÌÈÄ)À» ±¸ÇÏ¿© ¾÷±×·¹À̵å ÇÏ¿©¾ß ÇÑ´Ù.
°ü·Ã URL CVE-2004-2578 (CVE)
°ü·Ã URL 10895 (SecurityFocus)
°ü·Ã URL 16970 (ISS)