Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New moin packages fix insufficient input sanitising |
| Informations | |||
|---|---|---|---|
| Name | DSA-1715 | First vendor Publication | 2009-01-29 |
| Vendor | Debian | Last vendor Modification | 2009-01-29 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that the AttachFile action in moin, a python clone of WikiWiki, is prone to cross-site scripting attacks (CVE-2009-0260). Another cross-site scripting vulnerability was discovered in the antispam feature (CVE-2009-0312). For the stable distribution (etch) these problems have been fixed in version 1.5.3-1.2etch2. For the testing (lenny) distribution these problems have been fixed in version 1.7.1-3+lenny1. For the unstable (sid) distribution these problems have been fixed in version 1.8.1-1.1. We recommend that you upgrade your moin packages. |
Original Source
| Url : http://www.debian.org/security/2009/dsa-1715 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13561 | |||
| Oval ID: | oval:org.mitre.oval:def:13561 | ||
| Title: | USN-716-1 -- moin vulnerabilities | ||
| Description: | Fernando Quintero discovered than MoinMoin did not properly sanitize its input when processing login requests, resulting in cross-site scripting vulnerabilities. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. This issue affected Ubuntu 7.10 and 8.04 LTS. Fernando Quintero discovered that MoinMoin did not properly sanitize its input when attaching files, resulting in cross-site scripting vulnerabilities. This issue affected Ubuntu 6.06 LTS, 7.10 and 8.04 LTS. It was discovered that MoinMoin did not properly sanitize its input when processing user forms. A remote attacker could submit crafted cookie values and overwrite arbitrary files via directory traversal. This issue affected Ubuntu 6.06 LTS, 7.10 and 8.04 LTS. It was discovered that MoinMoin did not properly sanitize its input when editing pages, resulting in cross-site scripting vulnerabilities. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that MoinMoin did not properly enforce access controls, which could allow a remoter attacker to view private pages. This issue only affected Ubuntu 6.06 LTS and 7.10. It was discovered that MoinMoin did not properly sanitize its input when attaching files and using the rename parameter, resulting in cross-site scripting vulnerabilities. It was discovered that MoinMoin did not properly sanitize its input when displaying error messages after processing spam, resulting in cross-site scripting vulnerabilities | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-716-1 CVE-2008-0780 CVE-2008-0781 CVE-2008-0782 CVE-2008-1098 CVE-2008-1099 CVE-2009-0260 CVE-2009-0312 | Version: | 5 |
| Platform(s): | Ubuntu 7.10 Ubuntu 8.04 Ubuntu 6.06 Ubuntu 8.10 | Product(s): | moin |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:19989 | |||
| Oval ID: | oval:org.mitre.oval:def:19989 | ||
| Title: | DSA-1715-1 moin - insufficient input sanitising | ||
| Description: | It was discovered that the AttachFile action in moin, a python clone of WikiWiki, is prone to cross-site scripting attacks (<a href="http://security-tracker.debian.org/tracker/CVE-2009-0260">CVE-2009-0260</a>). Another cross-site scripting vulnerability was discovered in the antispam feature (<a href="http://security-tracker.debian.org/tracker/CVE-2009-0312">CVE-2009-0312</a>). | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1715-1 CVE-2009-0260 CVE-2009-0312 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | moin |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:8023 | |||
| Oval ID: | oval:org.mitre.oval:def:8023 | ||
| Title: | DSA-1715 moin -- insufficient input sanitising | ||
| Description: | It was discovered that the AttachFile action in moin, a python clone of WikiWiki, is prone to cross-site scripting attacks (CVE-2009-0260). Another cross-site scripting vulnerability was discovered in the antispam feature (CVE-2009-0312). | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1715 CVE-2009-0260 CVE-2009-0312 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | moin |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-07-29 | Name : Fedora Core 10 FEDORA-2009-7761 (moin) File : nvt/fcore_2009_7761.nasl |
| 2009-06-23 | Name : Fedora Core 10 FEDORA-2009-6557 (moin) File : nvt/fcore_2009_6557.nasl |
| 2009-06-23 | Name : Fedora Core 9 FEDORA-2009-6559 (moin) File : nvt/fcore_2009_6559.nasl |
| 2009-05-20 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin4.nasl |
| 2009-05-20 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin5.nasl |
| 2009-04-28 | Name : Fedora Core 9 FEDORA-2009-3845 (moin) File : nvt/fcore_2009_3845.nasl |
| 2009-04-28 | Name : Fedora Core 10 FEDORA-2009-3868 (moin) File : nvt/fcore_2009_3868.nasl |
| 2009-02-02 | Name : Debian Security Advisory DSA 1715-1 (moin) File : nvt/deb_1715_1.nasl |
| 2009-02-02 | Name : FreeBSD Ports: moinmoin File : nvt/freebsd_moinmoin3.nasl |
| 2009-02-02 | Name : Ubuntu USN-716-1 (moin) File : nvt/ubuntu_716_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 51632 | MoinMoin security/antispam.py Disallowed Content XSS |
| 51485 | MoinMoin action/AttachFile.py Multiple Parameter XSS |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-05-14 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_fc4d0ae83fa311dea3fd0030843d3802.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3868.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-716-1.nasl - Type : ACT_GATHER_INFO |
| 2009-04-22 | Name : The remote Fedora host is missing a security update. File : fedora_2009-3845.nasl - Type : ACT_GATHER_INFO |
| 2009-02-01 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_6a523dbaeeab11ddab4f0030843d3802.nasl - Type : ACT_GATHER_INFO |
| 2009-01-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1715.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:28:10 |
|
