[Pkg-sympa-devel] Bug#672859: wwsympa.fcgi fails to check download/delete permissions properly

[George Kargiotakis]

Package: sympa
Version: 6.0.1+dfsg-4
Severity: grave

Sympa versions <6.1.11 have a severe security issue where any user can
download or delete the archives of a mailing list if they know the name
of the list.

Debian has been tracking it at http://security-tracker.debian.org/tracker/CVE-2012-2352

I'm attaching a patch (taken from upstream commit:
https://sourcesup.renater.fr/scm/viewvc.php/branches/sympa-6.0-branch/wwsympa/wwsympa.fcgi.in?root=sympa&pathrev=7358 ) that fixes the problem

-- System Information:
Debian Release: 6.0.4
  APT prefers stable
  APT policy: (800, 'stable'), (650, 'testing'), (500, 'stable-updates')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=el_GR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
-------------- next part --------------
--- wwsympa.fcgi	2012-05-14 11:53:36.000000000 +0300
+++ wwsympa.fcgi	2012-05-14 11:55:09.000000000 +0300
@@ -15956,6 +15956,11 @@
 sub do_arc_manage {
     &wwslog('info', "do_arc_manage ($in{'list'})");
 
+	## Access Control
+	unless (defined &check_authz('do_arc', 'web_archive.access')) {
+		return undef;
+	}
+
     my $search_base = $wwsconf->{'arc_path'}.'/'.$list->get_list_id();
     opendir ARC, "$search_base";
     foreach my $dir (sort {$b cmp $a} grep(!/^\./,readdir ARC)) {
@@ -15972,6 +15977,11 @@
 sub do_arc_download {
     
     &wwslog('info', "do_arc_download ($in{'list'})");
+
+	## Access Control
+	unless (defined &check_authz('do_arc', 'web_archive.access')) {
+		return undef;
+	}
     
     ##zip file name:listname_archives.zip  
     my $zip_file_name = $in{'list'}.'_archives.zip';
@@ -16072,6 +16082,11 @@
     my @abs_dirs;
     
     &wwslog('info', "do_arc_delete ($in{'list'})");
+
+	## Access Control
+	unless (defined &check_authz('do_arc', 'web_archive.access')) {
+		return undef;
+	}
     
     unless (defined  $in{'directories'}){
       	&report::reject_report_web('user','select_month',{},$param->{'action'});