Menu:

Recent Entries

About

Sirius

板工秀勇與阿吉管理中

Categories

Ubuntu相關 [1]
FreeNX [1]
Windows相關 [5]
有關模板 [5]
學用Blog [2]
LightBox [2]
xoops [5]
硬體相關 [2]
MySQL [4]
TinyMCE [3]
Lifetype系統更新 [10]
系統修改 [4]
校務系統 [3]
XPress [1]
IMageMagick [1]
CSS [1]
站務公告 [7]
Plugins套用修改 [3]
設備使用 [1]
Moodle [1]
電腦教室管理 [0]

Links

LiftType教學
- LifeType 線上教學(官網)
- 部落格教室(怡杰老師)
- 阿欣部落
- 阿杰老師部落格教室

Syndicate

RSS 0.90
RSS 1.0
RSS 2.0
Atom 0.3

Version:

andreas01 v1.3

phpmailer 的 shell command 漏洞修補

sirius | 04 十月, 2007 10:29

XOOPS的漏洞修補
本文引用自:http://xoops.tnc.edu.tw/modules/news/index.php?storytopic=7 

phpmailer 是許多套件採用的 PHP 類別, 用來提供傳遞電子郵件的功能。

phpmailer 在 sendmail_send 函式的處理有 bug,可造成執行任意程式碼的漏洞。

修補方法: 利用 escapeshellcmd 和 escapeshellarg 做安全過濾。

方法一: 自行手動修改

XOOPS 2.0.x 的使用者,請編輯 class/mail/phpmailer/class.phpmailer.php

把:

function SendmailSend($header, $body) { if ($this->Sender != "") $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender); else $sendmail = sprintf("%s -oi -t", $this->Sendmail);

改為:

function SendmailSend($header, $body) { if ($this->Sender != "") $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender)); else $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));

XOOPS 2.2.x 的使用者,請編輯 class/mail/phpmailer/class.phpmailer.php

把:

function sendmail_send($header, $body) { if ($this->Sender != "") $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender); else $sendmail = sprintf("%s -oi -t", $this->Sendmail);

改成:

function sendmail_send($header, $body) { if ($this->Sender != "") $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender)); else $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));
====
方法二:

或者把以下的修正檔放入 class/mail/phpmailer 目錄中, 解壓覆蓋掉 class.phpmailer.php

XOOPS 2.0.x 的使用者,請下載:
http://xoops.tnc.edu.tw/uploads/xoops-2.0-phpmailer-class.zip

XOOPS 2.2.x 的使用者,請下載:
http://xoops.tnc.edu.tw/uploads/xoops-2.2-phpmailer-class.zip


消息來源:

http://h.root.tw/modules/news/article.php?storyid=40

Posted in xoops . 迴響: (3171). 引用:(4). 靜態連結網址
«Next post | Previous post»

Comments

  1. 1. organic energy drinks  |  06/17,2021 at 07:15

    It's awesome to visit this website and reading
    the views of all colleagues on the topic of this post, while I am also eager of getting knowledge.

  2. 2. 서울오피  |  06/17,2021 at 05:32

    I was extremely pleased to uncover this website. I need to to thank you for your time for this
    particularly fantastic read!! I definitely really liked every bit of it and i also have you saved to fav to look at new information in your
    site.

  3. 3. Unblock torrent Sites  |  06/17,2021 at 05:25

    Greetings! Very helpful advice within this post! It is the little changes which
    will make the greatest changes. Thanks for sharing!

  4. 4. slot online  |  06/17,2021 at 05:20

    I just like the valuable information you provide to
    your articles. I will bookmark your weblog and take a look at again here regularly.
    I am somewhat sure I'll be told many new stuff proper right here!
    Best of luck for the next!

  5. 5. 퍼스트 카지노  |  06/17,2021 at 05:09

    I have read so many posts on the topic of the blogger lovers
    however this paragraph is in fact a fastidious article, keep it up.

  6. 6. affordable polarized sunglasses  |  06/17,2021 at 05:08

    great post, very informative. I'm wondering why the other experts of
    this sector do not notice this. You should proceed your writing.
    I'm confident, you've a huge readers' base already!

  7. 7. Holly  |  06/17,2021 at 05:07

    Outstanding post however I was wanting to know if you could write a litte more on this topic?
    I'd be very thankful if you could elaborate a little bit more.
    Many thanks!

  8. 8. zero-market.net  |  06/17,2021 at 04:58

    There is obviously a bundle to know about this.
    I consider you made various good points in features also.

  9. 9. virginia dui defense attorney  |  06/17,2021 at 04:48

    Hello my loved one! I wish to say that this post is amazing, great written and come with almost all
    important infos. I'd like to look more posts like this .

  10. 10. togel hongkong  |  06/17,2021 at 04:32

    I know this site gives quality depending articles or reviews
    and extra information, is there any other website which offers these information in quality?

  11. 11. used car auto parts  |  06/17,2021 at 04:25

    You actually make it seem so easy with your presentation but I find this matter to be actually
    something which I think I would never understand.

    It seems too complex and extremely broad for me.
    I am looking forward for your next post, I'll try to get the
    hang of it!

  12. 12. Michael Deem  |  06/17,2021 at 04:23

    Everything is very open with a really clear explanation of the issues.

    It was really informative. Your site is useful.

    Thanks for sharing!

  13. 13. học nấu ăn ngon  |  06/17,2021 at 04:23

    you are actually a just right webmaster. The site loading pace is incredible.
    It kind of feels that you are doing any distinctive trick.
    Moreover, The contents are masterpiece. you've performed
    a great activity in this subject!

  14. 14. private driver nice airport  |  06/17,2021 at 04:06

    I like what you guys are up too. This type of clever work and coverage!

    Keep up the great works guys I've included you guys to my own blogroll.

  15. 15. 농구토토  |  06/17,2021 at 03:34

    Hi there, this weekend is pleasant in favor of me, because this moment i am
    reading this impressive educational post here at my residence.

  16. 16. minneapolis custom building a home  |  06/17,2021 at 03:21

    We stumbled over here different page and thought I should check things out.
    I like what I see so now i'm following you. Look forward to exploring
    your web page for a second time.

  17. 17. Singapore Furniture Press Release  |  06/17,2021 at 03:08

    Its like you read my mind! You appear too know so much about this,
    like you wrote the book in it or something.I think that yyou can do with some pics to drive the message home a bit, but instead of that, this is great blog.
    A great read. I will certainly be back.

  18. 18. situs judi kartu Online  |  06/17,2021 at 03:00

    Thanks for some other informative website. Where else may I am
    getting that kind of information written in such a perfect manner?
    I have a challenge that I'm just now running on, and I've
    been on the look out for such info.

  19. 19. slotdaftardana.wildapricot.org  |  06/17,2021 at 02:51

    Everyone loves it when individuals get together and share thoughts.
    Great website, stick with it!

  20. 20. tgfg  |  06/17,2021 at 02:40

    It's an awesome post in favor of all the online visitors;
    they will take benefit from it I am sure.

Leave a Reply

發表迴響
 authimage