[Fwd: Authentication misbehaviour of PEARs File_Passwd]

-------- Original Message -------- Subject: Authentication misbehaviour of PEARs File_Passwd Date: Tue, 15 Mar 2005 14:44:42 +0100 From: Michael Wallner <mike@php.net> To: phpsec@phparch.com Someone (pear_php at ibink dot com) reported [1] a serious misbehaviour of PEARs File_Passwd package's authentication capabilities. Details: ======== Due to inproper matching of user ids in File_Passwd_*::staticAuth() respectivly in File_Passwd_Common::_auth() methods, one could have authenticated with only a part of the username (i.e. authenticate "some_user" just with supplying "some" as user id). This bug additionally causes another misbehaviour which made user ids containing previous user ids (in fact if any field of the data set contained the user id which was looked up) impossible to authenticate. Solution: ========= This issues have been addressed in the latest release of File_Passwd. Everyone is strongly encouraged to upgrade ones File_Passwd installation to the current stable release, which is 1.1.3 at the time of this writing [2]. [1] http://pear.php.net/bugs/bug.php?id=3784 [2] http://pear.php.net/get/File_Passwd-1.1.3.tgz Regards, -- Michael - < mike(@)php.net >

Attachment: [application/pgp-signature] OpenPGP digital signature signature.asc