Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 433774 (CVE-2012-4377) - <www-apps/mediawiki-1.19.2: Multiple Vulnerabilities (CVE-2012-{4377,4378,4379,4380,4381,4382})
Summary: <www-apps/mediawiki-1.19.2: Multiple Vulnerabilities (CVE-2012-{4377,4378,437...
Alias: CVE-2012-4377
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: B4 [noglsa]
Depends on:
Reported: 2012-09-03 11:01 UTC by Agostino Sarubbo
Modified: 2012-12-10 22:55 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2012-09-03 11:01:49 UTC
A weakness, two security issues and some vulnerabilities have been reported in MediaWiki, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting, script insertion, and cross-site request forgery attacks and bypass certain security restrictions.

1) Input passed via the comment of a "File:" tag to a non-existing file is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site if malicious data is viewed.

2) Input passed via the "uselang" parameter to index.php is not properly sanitised before being returned to the user via certain gadgets. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) The application allows users to perform certain actions HTTP requests without performing proper validity checks to verify the requests. This can be exploited to perform certain unspecified actions when a logged-in user visits a specially crafted web page.

4) An error when handling IP address blocking of the GlobalBlocking extension can be exploited to bypass the blocking mechanism and e.g. create an account from a blocked address.

5) The application stores user credentials used via external authentication plugins (e.g. LDAP extension) additionally in the local database and can potentially be exploited to bypass the strict function of an authentication plugin and log-in by using an old password.

6) An error when handling the blocking of users can be exploited to disclose the block reason via another block attempt.

Successful exploitation of this weakness requires administrative privileges.

The weakness, security issues, and vulnerabilities are reported in versions prior to 1.18.5 and prior to 1.19.2.

Update to version 1.18.5 or 1.19.2 and apply the vendor workaround in case only external authentication is used (please see the vendor's advisory for details).
Comment 1 Agostino Sarubbo gentoo-dev 2012-09-03 11:02:32 UTC
@maintainer: can we stabilize that version?
Comment 2 Tim Harder gentoo-dev 2012-09-04 05:45:59 UTC
(In reply to comment #1)
> @maintainer: can we stabilize that version?

Go ahead.
Comment 3 Tim Sammut (RETIRED) gentoo-dev 2012-09-04 14:43:13 UTC
Thanks, Tim.

Arches, please test and mark stable:
Target keywords : "amd64 ppc x86"
Comment 4 Agostino Sarubbo gentoo-dev 2012-09-07 08:43:01 UTC
amd64 stable
Comment 5 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2012-09-13 07:18:45 UTC
x86 stable
Comment 6 Brent Baude (RETIRED) gentoo-dev 2012-10-05 17:06:58 UTC
ppc done
Comment 7 Agostino Sarubbo gentoo-dev 2012-10-05 17:15:38 UTC
all arches done, please vote
Comment 8 Tim Sammut (RETIRED) gentoo-dev 2012-12-10 20:33:09 UTC
Thanks, folks. GLSA Vote: no.
Comment 9 Sean Amoss (RETIRED) gentoo-dev Security 2012-12-10 22:55:00 UTC
GLSA vote: no. 

Closing noglsa.