SlashcodeSlash Open Source ProjectFull disclosure on Friday's security issue, and new patch- January 7, 2008 On Friday, January 4, 2008, a serious security vulnerability was discovered, and an exploit demonstrated, in the then-current version of Slash. The vulnerability was an SQL injection. Its effect was to allow a user with no special authorization to read any information from any table the Slash site's mysql user was authorized to read (which may include other databases, including information_schema). This vulnerability has been present in Slash for years. We are not going to list which specific...http://www.slashcode.com/article.pl?sid=08/01/07/2314232&from=rss Security: add 'id' to filter_params- January 4, 2008 Whatever version of Slash you are running, please add 'id' to the list of numeric filtered parameters. This list can be found in the filter_params subroutine in Environment.pm. If you are on near-current code, you can just update to current code, as the fix is in CVS. If not, here is the (extremely simple) diff: diff -U3 -r1.223 -r1.224 --- SlashUtilityEnvironmentEnvironment.pm 24 Oct 2007 21:19:34 -0000 1.223 +++ SlashUtilityEnvironmentEnvironment.pm 4 Jan 2008 19:14:07 -0000 1.224 -1823,7...http://www.slashcode.com/article.pl?sid=08/01/04/1950244&from=rss |