This update closes three remotely exploitable security
vulnerabilities in lurker. All lurker versions from 0.1a to 2.0 are
affected. The initial vulnerabilities were discovered by Moritz Naumann.
The specific weaknesses which have been closed include:
1. Reading any file accessible to the user executing lurker.cgi
2. (Over)writing chosen files in any writable directory called mbox
3. Stealing users' browser cookies via cross-site scripting
An updated version of the source package is now available on
sourceforge:
http://prdownloads.sourceforge.net/lurker/lurker-2.1.tar.gz?download
Fixed debian packages from Jonas Meurer are available at:
http://terpstra.ca/lurker-security/
All previous versions have been removed from the sourceforge website.
In approximately two weeks from now, there will be a full
vulnerability disclosure, including example exploit URLs.
Please update your systems.
(text/plain)
