Security Vulnerability Fixed

Posted on Sunday, April 15, 2007

Users have reported a security vulnerability in Pixaria which can be exploited if PHP's register_globals variable is turned on.

My current advice is for everyone to upgrade to the newly released version 1.4.3 or if that's not possible, to install this patched file: class.Smarty.php.zip into resources/includes on your current installation.

For reference, the installation documentation of Pixaria has been updated with information on how to prevent malicious access to Pixaria's 'include' and 'libraries' scripts as this can easily be prevented by creating a text file called .htaccess with the following text in it:


Order Deny,Allow 
Deny from all

This file should then be uploaded to:

-/resources/incoming/
-/resources/library/
-/resources/includes/
-/resources/pixies/
-/resources/smarty/

To test whether this is working on your site, browse to these directories using your web browser like this:

http://www.mysite.com/pixaria/resources/includes/

You should get an error message and access denied warning.

Comments for this article

blog comments powered by Disqus

Security Vulnerability Fixed

Comments for this article

Recent Entries

Categories

Archives