Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | New ikiwiki packages fix regression |
| Informations | |||
|---|---|---|---|
| Name | DSA-1553 | First vendor Publication | 2008-04-20 |
| Vendor | Debian | Last vendor Modification | 2008-06-01 |
| Severity (Vendor) | N/A | Revision | 2 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 4.3 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The update of ikiwiki in DSA-1553-1 caused two regressions. An updated version of ikiwiki is available that fixes these problems. For reference, the full advisory text is below. It has been discovered that ikiwiki, a Wiki implementation, does not guard password and content changes against cross-site request forgery (CSRF) attacks. For the stable distribution (etch), this problem has been fixed in version 1.33.6. For the unstable distribution (sid), this problem has been fixed in version 2.42. We recommend that you upgrade your ikiwiki package. |
Original Source
| Url : http://www.debian.org/security/2008/dsa-1553 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-352 | Cross-Site Request Forgery (CSRF) (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18725 | |||
| Oval ID: | oval:org.mitre.oval:def:18725 | ||
| Title: | DSA-1553-1 ikiwiki - cross-site request forgery | ||
| Description: | It has been discovered that ikiwiki, a Wiki implementation, does not guard password and content changes against cross-site request forgery (CSRF) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1553-1 CVE-2008-0165 | Version: | 9 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ikiwiki |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:7927 | |||
| Oval ID: | oval:org.mitre.oval:def:7927 | ||
| Title: | DSA-1553 ikiwiki -- cross-site request forgery | ||
| Description: | It has been discovered that ikiwiki, a Wiki implementation, does not guard password and content changes against cross-site request forgery (CSRF) attacks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1553 CVE-2008-0165 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | ikiwiki |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-09-04 | Name : FreeBSD Ports: ikiwiki File : nvt/freebsd_ikiwiki1.nasl |
| 2008-06-11 | Name : Debian Security Advisory DSA 1553-2 (ikiwiki) File : nvt/deb_1553_2.nasl |
| 2008-04-21 | Name : Debian Security Advisory DSA 1553-1 (ikiwiki) File : nvt/deb_1553_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 44657 | ikiwiki User Preferences Multiple Form CSRF |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-04-22 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1553.nasl - Type : ACT_GATHER_INFO |
| 2008-04-17 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_8d2c0ce108b611dd94b40016d325a0ed.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:27:33 |
|
