Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 20 Jan 2010 00:42:13 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: dokuwiki

In case anyone needs this extra info, here are the commits of the fixes
and of the vulnerable code:

On Tue, Jan 19, 2010 at 03:19:37PM -0500, Josh Bressers wrote:
> http://bugs.splitbrain.org/index.php?do=details&task_id=1847
> http://secunia.com/advisories/38183/
> - directory structure information leak
> - insufficient permissions checks, allowing attacker to change ACLs

http://github.com/splitbrain/dokuwiki/commit/96a47e5d480e6c5b3aab1884a8536ec4b8ca2fab
http://github.com/splitbrain/dokuwiki/commit/8c5215b744582107f352aa4ccea4182296674250

> http://bugs.splitbrain.org/index.php?do=details&task_id=1853
> http://secunia.com/advisories/38205/
> - missing CSRF protections in ACL manager

http://github.com/splitbrain/dokuwiki/commit/d7554c0bb25241c1299af28785878d31ad02dbad
http://github.com/splitbrain/dokuwiki/commit/cce7ae9882da5682192e7153f5b2b5cfdcf5f0ec

According to the blog post, "all bugs are in the new ACL Manager
introduced in 2008-05-05".  The vulnerable code appears to have been
committed on "Sat Nov 17 07:57:40 -0800 2007":

http://github.com/splitbrain/dokuwiki/commit/2a3623da3390f0118660d541928ae8c635631b3d#diff-1

According to http://www.dokuwiki.org/changes , there was no release
between 2007-06-26 and 2008-05-05, which must be why only the latter
date was mentioned.

> So for CVE assignment:
> 
> CVE-2010-0287
> - directory structure information leak
> 
> CVE-2010-0288
> - insufficient permissions checks, allowing attacker to change ACLs
> 
> 
> CVE-2010-0289
> - missing CSRF protections in ACL manager

Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.