Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 29 Dec 2012 20:40:32 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Tilmann Haak <tilmann@...pwiki.de>, tw-public@....de
Subject: Re: CVE request: MoinMoin Wiki (remote code execution
 vulnerability)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/29/2012 07:11 AM, Tilmann Haak wrote:
> Hi all,
> 
> there is a remote code execution vulnerability in MoinMoin wiki,
> versions 1.9.x up to (and including) 1.9.5. The method save in class
> AnyWikiDraw (action/anywikidraw.py) and class TWikiDraw
> (action/twikidraw.py) do not filter user supplied input correctly, which
> leads to a path traversal vulnerability, which can be exploited to
> execute arbitrary code with moin's privileges. An exploit was seen in
> the wild.
> 
> Details can be found at: http://moinmo.in/SecurityFixes
> 
> A fix is available at: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f
> 
> Could someone please assign a CVE number?
> 
> kind regards,
>   Tilmann

Please use CVE-2012-6081 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQ37ewAAoJEBYNRVNeJnmT66YP/0pSF6gHCwqGCkd/xj4rgc7d
fdxIee2hu4eQHpQg6Juqn//eFKY6ToHMwMXaKnUGJohCE5ZfrjZeqkd3e85no9Kc
lSrpBox7xt0dyzpQg3bPMc7Q850cQgQPo7lhLmrvr9qjOt7qCfzIdbzxMWoGGOC2
yxQAzp1q5lL/4fSBZ+SIQRU/HfP/rZsQRDwV8dc3CNKpHVPuBl0sycqd69VxCKeY
gd4syt26rgoJCQvFdnDEDbZh7+ItBz1opyqOlCzClZK4OTWGbOijPjDvkv0HgDmY
zNbKzJgh2lWVynxKaiqfO2Ae+fvwj46LCD1QdqO3JyO0MUGPK2mtXLGJT81TUM1s
C2Es1cJqA2losdgU7BrZdaCV5kzeAiI4q9RjnU0mTHYpvihXazOQ3reQDiJzwWTP
ZhDcFzsk1xr1/6Pf4oWDaYRq0j7x7fXZ+AJhAncDLl1LwDfIyUIb7pd6Qhf2EIxP
/W4xPedwGFIEKHqz34N/O+NUUhhdmZYWrDxJY1kSi5in7eGKi1kuZIXo24j5zRJb
IHuzWlL2PDQq55bO0vEmO5Jf1nDiB/63KrESOKW/cq854nlC7C14WvmnHDLVVL7F
9akfA9ezLNEPRTY9B0B6IoPEwrlsszbNUc2X35Nr45XvfL3fYC7L/UvvlOvLHfrn
g/rHKJSADdF1cjGs9lcv
=Pu+I
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ