[ GLSA 200510-23 ] TikiWiki: XSS vulnerability

[Thierry Carrez]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig0E1BF229664678989D9AD4AF
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200510-23
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: TikiWiki: XSS vulnerability
Date: October 28, 2005
Bugs: #109858
ID: 200510-23

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

TikiWiki is vulnerable to cross-site scripting attacks.

Background
==========

TikiWiki is a web-based groupware and content management system (CMS),
using PHP, ADOdb and Smarty.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/tikiwiki < 1.9.1.1 >= 1.9.1.1

Description
===========

Due to improper input validation, TikiWiki can be exploited to perform
cross-site scripting attacks.

Impact
======

A remote attacker could exploit this to inject and execute malicious
script code or to steal cookie-based authentication credentials,
potentially compromising the victim's browser.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All TikiWiki users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.1.1"

Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200510-23.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


--------------enig0E1BF229664678989D9AD4AF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDYgybvcL1obalX08RAnJXAJ9stG0m1cjI5f6cSeUR5i s73k2bbACgpXIX
Anc9PI4Ylzcal3I3KBE0Pg4=
=aHmQ
-----END PGP SIGNATURE-----

--------------enig0E1BF229664678989D9AD4AF--

[Thierry Carrez]

dave canuck wrote:
> Silly quesiton: Does this cover all OS's?

This is a general TikiWiki issue, it's not OS-dependant.

See 1.9.1.1 announcement at :
http://tikiwiki.org/tiki-read_article.php?articleId=118

--
Thierry Carrez (Koon)

[dave canuck]

Silly quesiton: Does this cover all OS's?

--- Thierry Carrez <koon@gentoo.org> wrote:

> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - - - - -
> Gentoo Linux Security Advisory
> GLSA 200510-23
> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - - - - -
>
> http://security.gentoo.org/
> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - - - - -
>
> Severity: Low
> Title: TikiWiki: XSS vulnerability
> Date: October 28, 2005
> Bugs: #109858
> ID: 200510-23
>
> - - - - - - - - - - - - - - - - - - - - - - - - - -
> - - - - - - - - - -
>
> Synopsis
> ========
>
> TikiWiki is vulnerable to cross-site scripting
> attacks.
>
> Background
> ==========
>
> TikiWiki is a web-based groupware and content
> management system (CMS),
> using PHP, ADOdb and Smarty.
>
> Affected packages
> =================
>
>
>
-------------------------------------------------------------------
> Package / Vulnerable /
> Unaffected
>
>
-------------------------------------------------------------------
> 1 www-apps/tikiwiki < 1.9.1.1
> >= 1.9.1.1
>
> Description
> ===========
>
> Due to improper input validation, TikiWiki can be
> exploited to perform
> cross-site scripting attacks.
>
> Impact
> ======
>
> A remote attacker could exploit this to inject and
> execute malicious
> script code or to steal cookie-based authentication
> credentials,
> potentially compromising the victim's browser.
>
> Workaround
> ==========
>
> There is no known workaround at this time.
>
> Resolution
> ==========
>
> All TikiWiki users should upgrade to the latest
> version:
>
> # emerge --sync
> # emerge --ask --oneshot --verbose
> ">=www-apps/tikiwiki-1.9.1.1"
>
> Note: Users with the vhosts USE flag set should
> manually use
> webapp-config to finalize the update.
>
> Availability
> ============
>
> This GLSA and any updates to it are available for
> viewing at
> the Gentoo Security Website:
>
> http://security.gentoo.org/glsa/glsa-200510-23.xml
>
> Concerns?
> =========
>
> Security is a primary focus of Gentoo Linux and
> ensuring the
> confidentiality and security of our users machines
> is of utmost
> importance to us. Any security concerns should be
> addressed to
> security@gentoo.org or alternatively, you may file a
> bug at
> http://bugs.gentoo.org.
>
> License
> =======
>
> Copyright 2005 Gentoo Foundation, Inc; referenced
> text
> belongs to its owner(s).
>
> The contents of this document are licensed under the
> Creative Commons - Attribution / Share Alike
> license.
>
> http://creativecommons.org/licenses/by-sa/2.0
>
>


------------------
Dave C, Admin, City of Pine
dave_canuck2001@yahoo.com




__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com