Just out of curiosity, is there a reason why you did not specify which
backends are vulnerable?
Yeah, I can go dig it up (and will) but the advisory would have been far
more useful if it included the list of vulnerable backends; end users
could know at a glance if they _need_ to upgrade.
Thanks again,
Ben
On Tue, 21 Feb 2006, Matt Van Gundy wrote:
> PRODUCT:
> PEAR::Auth Authentication Module Package
> http://pear.php.net/package/Auth
>
> VERSIONS AFFECTED:
> All versions < 1.2.4
> 1.3 series < 1.3.0r4
>
> DESCRIPTION:
> Some of the PEAR::Auth Container back ends do not fully validate
> ...
Just out of curiosity, is there a reason why you did not specify which
backends are vulnerable?
Yeah, I can go dig it up (and will) but the advisory would have been far
more useful if it included the list of vulnerable backends; end users
could know at a glance if they _need_ to upgrade.
Thanks again,
Ben
On Tue, 21 Feb 2006, Matt Van Gundy wrote:
> PRODUCT:
> PEAR::Auth Authentication Module Package
> http://pear.php.net/package/Auth
>
> VERSIONS AFFECTED:
> All versions < 1.2.4
> 1.3 series < 1.3.0r4
>
> DESCRIPTION:
> Some of the PEAR::Auth Container back ends do not fully validate
> ...
[ reply ]