ldap-account-manager does not escape HTML special chars

1 msg	Bug#417328: links2: should not be part of any s...
1 msg	ulogd to multiple logfiles?
2 msg	Gary Bueltel is in Colorado Springs
1 msg	Re: In bentley
1 msg	Re: [SECURITY] [DSA 1271-1] New openafs package...
1 msg	Le Bon Calcul Sofinco : Mini taux pour vos projets
1 msg	Re: Which hearty
2 msg	Help on OpenOffice.org security upgrade requested
1 msg	lookup floorboard

ldap-account-manager does not escape HTML speci...
\ Roland Gruber (21 Mar 2007)

5 msg	Re: [SECURITY] [DSA 1270-1] New OpenOffice.org ...
1 msg	Sumar TIR Magazin martie 2007
2 msg	Hardened linux (debian) recommendation?
1 msg	ג מעגוע
1 msg	John chapter 4:vs23-24.
5 msg	Re: [SECURITY] [DSA 1266-1] New gnupg packages ...
4 msg	initrd without root console?
1 msg	Greetings
1 msg	Urgent mail from Flavia
2 msg	Can you help me for erroe in syslog

Subject:	ldap-account-manager does not escape HTML special chars
Group:	Debian-security
From:	Roland Gruber
Date:	21 Mar 2007

severity 415379 grave
tags 415379 + security
stop

Hi Debian security,

a user reported that LAM does not escape HTML special chars if such data
is read from LDAP and displayed in the browser. E.g. the LDAP attribute
which stores an account description could include "<", ">" and such chars.

Possible attack targets:

Admin users who manage user and group accounts with LAM. LAM only allows
a predefined list of admin users to use this application. Therefore only
these persons can be attacked.

Needed priviledges to start attack:

An attacker needs write access to the LDAP directory. This requires an
valid LDAP account and LDAP ACLs which allow this account to write data.
By default only admin users have write access. But ordinary users may
also get access to change their mail address etc.

Affected releases:

Debian stable: ldap-account-manager 0.4.9-2
Debian Etch/testing: ldap-account-manager 1.1.1-1
Debian Unstable: ldap-account-manager 1.2.0-1

I will build patches right now.

--

Best regards

Roland Gruber

LDAP Account Manager
http://lam.sourceforge.net

Want more? Get LDAP Account Manager Pro!
http://lam.sourceforge.net/lamPro/index.htm