[Full-Disclosure] [ GLSA 200502-33 ] MediaWiki: Multiple vulnerabilities

From: Thierry Carrez (koon_at_gentoo.org)
Date: 02/28/05

  • Next message: Marcus Specht: "Re: [Full-Disclosure] client - server" 
    Date: Mon, 28 Feb 2005 21:55:31 +0100
To: gentoo-announce@lists.gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200502-33
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Low
         Title: MediaWiki: Multiple vulnerabilities
          Date: February 28, 2005
          Bugs: #80729, #82954
            ID: 200502-33

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    MediaWiki is vulnerable to cross-site scripting, data manipulation and
    security bypass attacks.

    Background
    ==========

    MediaWiki is a collaborative editing software, used by big projects
    like Wikipedia.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 www-apps/mediawiki < 1.3.11 >= 1.3.11

    Description
    ===========

    A security audit of the MediaWiki project discovered that MediaWiki is
    vulnerable to several cross-site scripting and cross-site request
    forgery attacks, and that the image deletion code does not sufficiently
    sanitize input parameters.

    Impact
    ======

    By tricking a user to load a carefully crafted URL, a remote attacker
    could hijack sessions and authentication cookies to inject malicious
    script code that will be executed in a user's browser session in
    context of the vulnerable site, or use JavaScript submitted forms to
    perform restricted actions. Using the image deletion flaw, it is also
    possible for authenticated administrators to delete arbitrary files via
    directory traversal.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All MediaWiki users should upgrade to the latest available version:

        # emerge --sync
        # emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.3.11"

    References
    ==========

      [ 1 ] Secunia Advisory SA14125
            http://secunia.com/advisories/14125/
      [ 2 ] CAN-2005-0534
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0534
      [ 3 ] CAN-2005-0535
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0535
      [ 4 ] CAN-2005-0536
            http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0536

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200502-33.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2005 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/2.0

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Marcus Specht: "Re: [Full-Disclosure] client - server"

    Relevant Pages