A vulnerability and a security issue have been reported in TWiki, which can be exploited by malicious people to cause a DoS (Denial of Service) and bypass certain security restrictions.

1) The problem is that it is possible to view restricted content via the rdiff and preview scripts.

Example:
http://[host]/bin/preview/[restricted content]/WebHome?action=foo

The security issue has been reported in releases TWikiRelease04x00x01 and TWikiRelease04x00x00.

2) An error in the handling of circular references for the "%INCLUDE" statement can be exploited to cause an infinite recursion and consume a large amount of memory resources on a vulnerable system by supplying a URL which references itself.

The vulnerability has been reported in the following releases:
* TWikiRelease04x00x01
* TWikiRelease04x00x00
* TWikiRelease04Sep2004
* TWikiRelease03Sep2004
* TWikiRelease02Sep2004
* TWikiRelease01Sep2004
* TWikiRelease01Feb2003
* TWikiRelease01Dec2001
* TWikiRelease01Sep2001

Solution
Apply patches (see vendor advisories).
Further details available to Secunia VIM customers

Provided and/or discovered by
The vendor credits:
1) Sergej Zagursky and Steffen Poulsen
2) Kenneth Lavrsen

Original Advisory
1) http://twiki.org/cgi-bin/view/Codev/SecurityAlertTWiki4RdiffPreviewAccess
2) http://twiki.org/cgi-bin/view/Codev/SecurityAdvisoryDosAttackWithInclude

Deep Links
Links available to Secunia VIM customers