[Secure-testing-team] Bug#673331: backuppc: fix for CVE-2011-5081

[Jamie Strandboge]

Package: backuppc
Version: 3.2.1-2
Severity: grave
Tags: patch security
Justification: user security hole
User: ubuntu-devel at lists.ubuntu.com
Usertags: origin-ubuntu quantal ubuntu-patch

Dear Maintainer,

In Ubuntu, the attached patch was applied to achieve the following:
  * SECURITY UPDATE: XSS in CGI/RestoreFile.pm
    - lib/BackupPC/CGI/RestoreFile.pm: update to escape share and backup
      number
    - CVE-2011-5081

I developed the attached patch and forwarded it upstream. I have not
heard back yet, but the patch is obvious and works here. Thanks for
considering the patch.


-- System Information:
Debian Release: wheezy/sid
  APT prefers precise-updates
  APT policy: (500, 'precise-updates'), (500, 'precise-security'), (500, 'precise')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-24-generic (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-------------- next part --------------
A non-text attachment was scrubbed...
Name: backuppc_3.2.1-2ubuntu2.debdiff
Type: text/x-diff
Size: 982 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20120517/9a2d3d3f/attachment.diff>