U radu programskog paketa DokuWiki, distribuiranog s operacijskim sustavom Fedora 16, otkrivena su dva sigurnosna nedostatka. Udaljenim napadačima omogućuju umetanje proizvoljne web skripte ili HTML koda.
Paket:
dokuwiki 0.x
Operacijski sustavi:
Fedora 16
Kritičnost:
3.7
Problem:
neodgovarajuća provjera ulaznih podataka, XSS
Iskorištavanje:
udaljeno
Posljedica:
umetanje HTML i skriptnog koda
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2012-2129, CVE-2012-2128
Izvorni ID preporuke:
FEDORA-2012-6628
Izvor:
Fedora
Problem:
Nedostaci su posljedica neodgovarajuće provjere ulaznih podataka predanih putem parametra "target" datoteci doku.php.
Posljedica:
Napadač ih može iskoristiti za umetanje proizvoljne web skripte ili HTML koda.
Rješenje:
Korisnicima se preporuča instalacija ispravljene inačice.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-6628
2012-04-26 03:07:10
--------------------------------------------------------------------------------
Name : dokuwiki
Product : Fedora 16
Version : 0
Release : 0.10.20110525.a.fc16
URL : http://www.dokuwiki.org/dokuwiki
Summary : Standards compliant simple to use wiki
Description :
DokuWiki is a standards compliant, simple to use Wiki, mainly aimed at creating
documentation of any kind. It has a simple but powerful syntax which makes sure
the datafiles remain readable outside the Wiki and eases the creation of
structured texts.
All data is stored in plain text files no database is required.
--------------------------------------------------------------------------------
Update Information:
Fix XSS Flaw
--------------------------------------------------------------------------------
ChangeLog:
* Tue Apr 24 2012 Andrew Colin Kissa <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 0-0.10.20110525.a
- Fix CVE-2012-2129
- Fix Bugzilla bugs #815123
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #815122 - CVE-2012-2128 CVE-2012-2129 dokuwiki: XSS and CSRF due
improper escaping of 'target' parameter in preprocessing edit form data
https://bugzilla.redhat.com/show_bug.cgi?id=815122
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update dokuwiki' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke