[Secure-testing-team] Bug#635544: Insufficient blacklist

[Moritz Muehlenhoff]

Package: glpi
Severity: important
Tags: security

The following was reported to oss-security:

--------
  it was found that GLPI, the Information Resource-Manager with an
additional Administration-Interface, did not properly blacklist
certain sensitive variables (like GLPI username and password). A
remote attacker could use this flaw to obtain access to plaintext form
of these values via specially-crafted HTTP POST request.

References:
[1] http://www.glpi-project.org/spip.php?page=annonce&id_breve=237&lang=en
[2] https://forge.indepnet.net/projects/glpi/versions/605
[3] https://forge.indepnet.net/issues/3017

Relevant patches:
[4]  https://forge.indepnet.net/projects/glpi/repository/revisions/14951
[5]  https://forge.indepnet.net/projects/glpi/repository/revisions/14952
[6]  https://forge.indepnet.net/projects/glpi/repository/revisions/14954
[7]  https://forge.indepnet.net/projects/glpi/repository/revisions/14955
[8]  https://forge.indepnet.net/projects/glpi/repository/revisions/14956
[9]  https://forge.indepnet.net/projects/glpi/repository/revisions/14957
[10] https://forge.indepnet.net/projects/glpi/repository/revisions/14958
[11] https://forge.indepnet.net/projects/glpi/repository/revisions/14960
[12] https://forge.indepnet.net/projects/glpi/repository/revisions/14966
--------

Since security support for glpi is limited it's sufficient to fix it
up in unstable.

Cheers,
        Moritz

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.0.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash