Home
Corporate Website
Jobs
Mailing Lists
RSS
Blog
New entry
Advertise
Software Inspectors
Scan Online
Personal (PSI)
Network (NSI 2.0)
- NEW -
Solutions For
Security Professionals
Security Vendors
Free Solutions For
Open Communities
Journalists & Media
Secunia Advisories
Search
Historic Advisories
Listed By Product
Listed By Vendor
Statistics / Graphs
Secunia Research
Report Vulnerability
About Advisories
Virus Information
Chronological List
Last 10 Virus Alerts
About Virus Information
Secunia Customers
Customer Area
MoinMoin Security Bypass Vulnerabilities
Secunia Advisory:
SA29894
Release Date:
2008-04-21
Last Update:
2008-04-28
Critical:
Less critical
Impact:
Security Bypass
Where:
From remote
Solution Status:
Vendor Patch
Software:
MoinMoin 1.x
CVE reference:
CVE-2008-1937
(Secunia mirror)
Want to know the next time vulnerabilities are fixed in this product?
-
Companies can be alerted via email and SMS!
Description
:
Some vulnerabilities have been reported in MoinMoin, which can be exploited by malicious users to bypass certain security restrictions.
1) An error in the user form processing can be exploited to bypass ACL rules or gain superuser privileges.
Successful exploitation requires that ACL entries other than "Known:" or "All:" are used, or that the superuser list is not empty.
2) An error in the ACL implementation can be exploited to bypass ACL rules.
Successful exploitation requires that "acl_hierarchic" is set to "True" (set to "False" by default).
The vulnerabilities are reported in versions prior to 1.6.3.
Solution
:
Update to version 1.6.3.
Provided and/or discovered by
:
Reported by the vendor.
Changelog
:
2008-04-28: Added CVE reference.
Original Advisory
:
http://moinmo.in/SecurityFixes
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
7 Related Secunia Security Advisories
1.
MoinMoin Multiple Vulnerabilities
2.
MoinMoin Multiple Cross-Site Scripting Vulnerabilities
3.
MoinMoin Script Insertion Vulnerabilities
4.
MoinMoin Unspecified Search ACL Security Bypass Vulnerability
5.
MoinMoin Unspecified Security Bypass Vulnerabilities
6.
MoinMoin Administrative Group Name Privilege Escalation Vulnerability
7.
MoinMoin Cross-Site Scripting Vulnerabilities
Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our
web form
or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
Secunia PSI
Scan | Patch | Track
Free Download
Secunia Poll
Do you think it's important to read Setup/User Guides for applications for use within your network?
Yes, I do it all the time
Yes, but I do it rarely
No
See Results
Most Popular Advisories
1.
Microsoft Windows CE Image Processing Vulnerabilities
2.
Internet Explorer "DisableCaching OfSSLPages" Weakness
3.
Sun Solaris Print Service Unspecified Vulnerabilities
4.
SUSE Update for Multiple Packages
5.
Sarg Multiple Unspecified Buffer Overflows
6.
Pngcrush libpng Unknown Chunk Processing Uninitialized Memory Access
7.
Fedora update for audacity
8.
Fedora update for cups
9.
Red Hat Directory Server Regular Expression Handler Buffer Overflow
10.
Fedora update for bugzilla
Vulnerability Management
-
Terms & Conditions
-
Copyright 2002-2008 Secunia
-
Compliance
-
Contact Secunia