Bug 350917 – <www-apps/mediawiki-1.16.1: Clickjacking Vulnerability (CVE-2011-0003)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tim Sammut (RETIRED) 2011-01-07 00:48:25 UTC]

From $URL:

Wikipedia user PleaseStand pointed out that MediaWiki has no
protection against "clickjacking". With user or site JavaScript or CSS
enabled, clickjacking can lead to cross-site scripting (XSS), and thus
full compromise of the wiki account of any user who visits a malicious
external site. Clickjacking affects all previous versions of MediaWiki.

Our fix involves denying framing on all pages except normal page views
and a few selected special pages. To be protected, all users need to
use a browser which supports X-Frame-Options. For information about
supported browsers, see:
<https://developer.mozilla.org/en/the_x-frame-options_response_header>

For more information about this vulnerability and the related patch, see:
<https://bugzilla.wikimedia.org/show_bug.cgi?id=26561>


Fixed version 1.16.1 is already in the tree (thanks, Tim/radhermit!) 

@web-apps, are we ok to call for stabilization of =www-apps/mediawiki-1.16.1?

[Comment 1 Tim Harder 2011-01-07 02:49:14 UTC]

(In reply to comment #0)
> Fixed version 1.16.1 is already in the tree (thanks, Tim/radhermit!)

No problem. :)

> @web-apps, are we ok to call for stabilization of =www-apps/mediawiki-1.16.1?

I'd say yes, since I was about to call for 1.16.0 stabilization until I noticed a new security release was out. I could also add the patch to something like 1.15.5-r1 if we want to keep a secure 1.15.x release in the tree a bit longer.

[Comment 2 Tim Sammut (RETIRED) 2011-01-07 05:43:18 UTC]

(In reply to comment #1)
> (In reply to comment #0)
> > @web-apps, are we ok to call for stabilization of =www-apps/mediawiki-1.16.1?
> 
> I'd say yes, since I was about to call for 1.16.0 stabilization until I noticed
> a new security release was out. I could also add the patch to something like
> 1.15.5-r1 if we want to keep a secure 1.15.x release in the tree a bit longer.
> 

Thank you. I think www-apps/mediawiki-1.16.1 is good.

Arches, please test and mark stable:
=www-apps/mediawiki-1.16.1
Target keywords : "amd64 ppc sparc x86"

[Comment 3 Tim Sammut (RETIRED) 2011-01-07 05:46:28 UTC]

Fixing typo in Summary; apologies for the spam.

[Comment 4 Agostino Sarubbo 2011-01-07 14:17:07 UTC]

amd64 ok

[Comment 5 Markos Chandras (RETIRED) 2011-01-07 17:55:53 UTC]

amd64 done. Thanks Agostino

[Comment 6 Christian Faulhammer (RETIRED) 2011-01-07 23:15:15 UTC]

x86 stable

[Comment 7 Brent Baude (RETIRED) 2011-01-09 14:00:12 UTC]

ppc done

[Comment 8 Raúl Porcel (RETIRED) 2011-02-12 17:56:20 UTC]

sparc stable

[Comment 9 Tim Sammut (RETIRED) 2011-02-12 18:08:06 UTC]

Thanks everyone. Closing NOGLSA.