Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Sign up!
EnGarde Community
What is the most important Linux security technology?
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Latest Newsletters
Linux Advisory Watch: March 27th, 2015
Linux Security Week: March 23rd, 2015
LinuxSecurity Newsletters
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

Ubuntu: 925-1: MoinMoin vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu It was discovered that MoinMoin did not properly sanitize its input whenprocessing Despam actions, resulting in cross-site scripting (XSS)vulnerabilities. If a privileged wiki user were tricked into performingthe Despam action on a page with a crafted title, a remote attacker couldexploit this to execute JavaScript code. (CVE-2010-0828) [More...]
Ubuntu Security Notice USN-925-1             April 08, 2010
moin vulnerabilities
CVE-2010-0828, CVE-2010-1238

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  python2.4-moinmoin              1.5.2-1ubuntu2.6

Ubuntu 8.04 LTS:
  python-moinmoin                 1.5.8-5.1ubuntu2.4

Ubuntu 8.10:
  python-moinmoin                 1.7.1-1ubuntu1.5

Ubuntu 9.04:
  python-moinmoin                 1.8.2-2ubuntu2.3

Ubuntu 9.10:
  python-moinmoin                 1.8.4-1ubuntu1.2

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that MoinMoin did not properly sanitize its input when
processing Despam actions, resulting in cross-site scripting (XSS)
vulnerabilities. If a privileged wiki user were tricked into performing
the Despam action on a page with a crafted title, a remote attacker could
exploit this to execute JavaScript code. (CVE-2010-0828)

It was discovered that the TextCha protection in MoinMoin could be bypassed
by submitting a crafted form request. This issue only affected Ubuntu 8.10.

Updated packages for Ubuntu 6.06 LTS:

  Source archives:
      Size/MD5:    48190 bcb94e3d181af844815cc13d979b6fee
      Size/MD5:      711 94969ba288edc08204be5c188e0e0ee1
      Size/MD5:  3975925 689ed7aa9619aa207398b996d68b4b87

  Architecture independent packages:
      Size/MD5:  1508824 480fd0e33b3cdcef687c09096a85e6fc
      Size/MD5:    70098 c0049e25be27ee4907592b2049870b65
      Size/MD5:   836924 5fa014d2a6e3ce7d8ab4b92e0c0d3c07

Updated packages for Ubuntu 8.04 LTS:

  Source archives:
      Size/MD5:    67966 4b6411462ec3e1d8a7dd5a5fff4a6099
      Size/MD5:      990 e8ac6c3c302a1e6aeb8af7fda61ce8d3
      Size/MD5:  4351630 79625eaeb65907bfaf8b3036d81c82a5

  Architecture independent packages:
      Size/MD5:  1662062 9a800d6ae893466b55207d530bb7c168
      Size/MD5:   943232 9a61e17b966714ca519e45064101b191

Updated packages for Ubuntu 8.10:

  Source archives:
      Size/MD5:    83136 ed41db28059cd77f82f3a7086eb655b2
      Size/MD5:     1351 e4bfab6c10cf06ef6ce52a740e13c22f
      Size/MD5:  5468224 871337b8171c91f9a6803e5376857e8d

  Architecture independent packages:
      Size/MD5:  4498914 60ebe69d19432563d61a4a2ed93cf738

Updated packages for Ubuntu 9.04:

  Source archives:
      Size/MD5:   104942 9dfd747b7096aa4c41e5bd0a5c62475a
      Size/MD5:     1354 8c79801a1d045a921232b98bd4d7f786
      Size/MD5:  5943057 b3ced56bbe09311a7c56049423214cdb

  Architecture independent packages:
      Size/MD5:  3903592 9613db079b1cb7a8acd10691cdb599a6

Updated packages for Ubuntu 9.10:

  Source archives:
      Size/MD5:   109654 e7573ab899ccd7ad99e7c0fc3f457b88
      Size/MD5:     1359 49e32b3944a61c7ade37ab07a89eb358
      Size/MD5:  5959517 6a91a62f5c0dd5379f3c2411c6629496

  Architecture independent packages:
      Size/MD5:  3925848 3df2b5c94d15d8bbbe78fd631232a165

< Prev   Next >


Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Tech Companies, Privacy Advocates Call for NSA Reform
Google warns of unauthorized TLS certificates trusted by almost all OSes
How Kevin Mitnick hacked the audience at CeBIT 2015
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2015 Guardian Digital, Inc. All rights reserved.