Debian: DSA-1371-1 Critical: phpWiki Remote File Upload Threat
debian
September 11, 2007
Several vulnerabilities have been discovered in phpWiki, a wiki engine
written in PHP
Topics Covered
Summary
It was discovered that phpWiki performs insufficient file name
validation, which allows unrestricted file uploads.
CVE-2007-2025
It was discovered that phpWiki performs insufficient file name
validation, which allows unrestricted file uploads.
CVE-2007-3193
If the configuration lacks a nonzero PASSWORD_LENGTH_MINIMUM,
phpWiki might allow remote attackers to bypass authentication via
an empty password, which causes ldap_bind to return true when used
with certain LDAP implementations.
The old stable distribution (sarge) does not contain phpwiki packages.
For the stable distribution (etch) these problems have been fixed in
version 1.3.12p3-5etch1.
For the unstable distribution (sid) these problems have been fixed in
version 1.3.12p3-6.1.
We recommend that you upgrade your phpmyadmin package.
Upgrade Instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If y...
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!