oss-security - Re: CVE Request: MediaWiki 1.15.3 -- Login CSRF

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <227162322.220811270685434080.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 7 Apr 2010 20:10:34 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE Request: MediaWiki 1.15.3 -- Login CSRF

Please use CVE-2010-1150 for this.

Thanks

-- 
    JB


----- "Reed Loden" <reed@...dloden.com> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Greetings,
> 
> MediaWiki 1.15.3 was just (20 min. ago) released[0] to fix a CSRF
> issue
> [1] in the login process, so need a CVE assigned to track the
> problem.
> 
> ============
> MediaWiki was found to be vulnerable to login CSRF. An attacker who
> controls a user account on the target wiki can force the victim to
> log
> in as the attacker, via a script on an external website. If the wiki
> is
> configured to allow user scripts, say with "$wgAllowUserJs = true" in
> LocalSettings.php, then the attacker can proceed to mount a
> phishing-style attack against the victim to obtain their password.
> 
> Even without user scripting, this attack is a potential nuisance, and
> so
> all public wikis should be upgraded if possible.
> 
> Our fix includes a breaking change to the API login action. Any
> clients
> using it will need to be updated. We apologise for making such a
> disruptive change in a minor release, but we feel that security is
> paramount.
> ============
> 
> Regards,
> ~reed
> 
> [0]
> http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html
> [1] https://bugzilla.wikimedia.org/show_bug.cgi?id=23076
> 
> - -- 
> Reed Loden - <reed@...dloden.com>
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> 
> iEYEARECAAYFAku7304ACgkQa6IiJvPDPVozkQCgv4DUtGwOzEgDY0m+/dNXbO/t
> LIQAnj7OdyY8THs+KjSbwRgri0O8Kbu1
> =lq2I
> -----END PGP SIGNATURE-----

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.