|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200502-33] MediaWiki: Multiple vulnerabilities Vulnerability Scan
Vulnerability Scan Summary
MediaWiki: Multiple vulnerabilities
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200502-33
(MediaWiki: Multiple vulnerabilities)
A security audit of the MediaWiki project discovered that
MediaWiki is vulnerable to several cross-site scripting and cross-site
request forgery attacks, and that the image deletion code does not
sufficiently sanitize input parameters.
Impact
By tricking a user to load a carefully crafted URL, a remote
attacker could hijack sessions and authentication cookies to inject
malicious script code that will be executed in a user's browser session
in context of the vulnerable site, or use JavaScript submitted forms to
perform restricted actions. Using the image deletion flaw, it is also
possible for authenticated administrators to delete arbitrary files via
directory traversal.
Workaround
There is no known workaround at this time.
References:
http://secunia.com/advisories/14125/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0534
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0535
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0536
Solution:
All MediaWiki users should upgrade to the latest available
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.3.11"
Threat Level: Low
Click HERE for more information and discussions on this network vulnerability scan.
|
