Bug 7950 - dokuwiki new security issues CVE-2011-3727 and CVE-2012-3354
: dokuwiki new security issues CVE-2011-3727 and CVE-2012-3354
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 2
: i586 Linux
: Normal Severity: minor
: ---
Assigned To: QA Team
:
: http://lwn.net/Vulnerabilities/522072/
: MGA2-64-OK MGA2-32-OK
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2012-11-01 20:45 CET by David Walser
Modified: 2012-12-11 23:02 CET (History)
3 users (show)

See Also:
Source RPM: dokuwiki-20120125-1.mga2.src.rpm
CVE:


Attachments

Description David Walser 2012-11-01 20:45:40 CET
Fedora has issued an advisory on October 22:
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090899.html

These are relatively minor issues, and can be fixed by upgrading to 20121013.

Mageia 2 is also affected.
Comment 1 David Walser 2012-12-11 16:47:12 CET
Updated packages uploaded for Mageia 2 and Cauldron.

Advisory:
========================

Updated dokuwiki package fixes security vulnerabilities:

DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information
via a direct request to a .php file, which reveals the installation path in an
error message, as demonstrated by lib/tpl/index.php and certain other files
(CVE-2011-3727).

A full path disclosure flaw was found in the way DokuWiki, a standards
compliant, simple to use Wiki, performed sanitization of HTTP POST 'prefix'
input value prior passing it to underlying PHP substr() routine, when the PHP
error level has been enabled on the particular server. A remote attacker could
use this flaw to obtain full path location of particular requested DokuWiki
page by issuing a specially-crafted HTTP POST request (CVE-2012-3354).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3354
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090899.html
========================

Updated packages in core/updates_testing:
========================
dokuwiki-20121013-1.mga2

from dokuwiki-20121013-1.mga2.src.rpm
Comment 2 Dave Hodgins 2012-12-11 21:55:40 CET
I'm testing this now.  Can you confirm this includes the fix for CVE-2012-0283
mentioned in the fedora announcement?
Comment 3 Dave Hodgins 2012-12-11 22:28:53 CET
Testing complete on Mageia 2 i586 and x86-64.

As this update was tested with the new version of php, please push after,
or at the same time, as the update validated in bug 8164.

Could someone from the sysadmin team push the srpm
dokuwiki-20121013-1.mga2.src.rpm
from Mageia 2 Core Updates Testing to Core Updates.

Advisory: Updated dokuwiki package fixes security vulnerabilities:

DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information
via a direct request to a .php file, which reveals the installation path in an
error message, as demonstrated by lib/tpl/index.php and certain other files
(CVE-2011-3727).

A full path disclosure flaw was found in the way DokuWiki, a standards
compliant, simple to use Wiki, performed sanitization of HTTP POST 'prefix'
input value prior passing it to underlying PHP substr() routine, when the PHP
error level has been enabled on the particular server. A remote attacker could
use this flaw to obtain full path location of particular requested DokuWiki
page by issuing a specially-crafted HTTP POST request (CVE-2012-3354).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3354
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090899.html

https://bugs.mageia.org/show_bug.cgi?id=7950
Comment 4 Thomas Backlund 2012-12-11 23:02:33 CET
Update pushed:
https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0362

Note You need to log in before you can comment on or make changes to this bug.