Your message dated Wed, 16 Feb 2005 11:47:31 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#295515: fixed in usemod-wiki 1.0-6
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 16 Feb 2005 12:24:21 +0000
>From [EMAIL PROTECTED] Wed Feb 16 04:24:21 2005
Return-path: <[EMAIL PROTECTED]>
Received: from meitner.df7cb.de [217.160.132.97] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D1OE9-00051l-00; Wed, 16 Feb 2005 04:24:21 -0800
Received: from planck.df7cb.de (dsl-213-023-226-172.arcor-ip.net
[213.23.226.172])
by meitner.df7cb.de (Postfix) with ESMTP id BB62B20C03F
for <[EMAIL PROTECTED]>; Wed, 16 Feb 2005 13:24:18 +0100 (CET)
Received: by planck.df7cb.de (Postfix, from userid 1000)
id 6E69D42BBC; Wed, 16 Feb 2005 13:24:08 +0100 (CET)
Date: Wed, 16 Feb 2005 13:24:08 +0100
From: Christoph Berg <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: usemod-wiki is vulnerable to XSS (CAN-2004-1397)
Message-ID: <[EMAIL PROTECTED]>
Mail-Followup-To: Christoph Berg <[EMAIL PROTECTED]>,
Debian Bug Tracking System <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="huq684BweRXVnRxX"
Content-Disposition: inline
X-Reportbug-Version: 3.2
X-Face: ([EMAIL PROTECTED](D\O)J!Qu\q4fh8W^7WGqxpwTk&Xy0*ya<[EMAIL
PROTECTED]/TA:l\Pde>wYj,M;75"
N13_k}S.rS#lmX[G]QOuw[H"4#z$tSn$SkV<IurN'6;gkRFZw@/XLtl7":0v&kN3*-iM~q*;.*CfH@
qM>5ucV193Tz3IWj<]8at(6"K.ht//s"Ds,xMV9A\_bN/)[EMAIL PROTECTED]>-dF34Kw?,<G0ya
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--huq684BweRXVnRxX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: usemod-wiki
Version: 1.0-6
Severity: grave
Justification: XSS vulnerability
Tags: sarge sid pending patch
Thanks to Djoume SALVETTI for making me aware of this:
> From CAN-2004-1397 :
>=20
> | Cross-site scripting (XSS) vulnerability in UseModWiki 1.0 allows
> | remote attackers to inject arbitrary web script or HTML via an
> | argument to wiki.pl.
>=20
> A "exploit" is also available here :
>=20
> http://www.securityfocus.com/bid/11924/exploit/
The following patch fixes this, upload due soon.
--- wiki.pl.org 2005-02-16 12:57:20.000000000 +0100
+++ wiki.pl 2005-02-16 13:08:59.000000000 +0100
@@ -378,6 +378,9 @@
sub Ts {
my ($text, $string) =3D @_;
=20
+ $string =3D~ s/&/&/g;
+ $string =3D~ s/</</g;
+ $string =3D~ s/>/>/g;
$text =3D T($text);
$text =3D~ s/\%s/$string/;
return $text;
Christoph
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (700, 'testing'), (600, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.25-planck
Locale: LANG=3Dde_DE.UTF-8, LC_CTYPE=3Dde_DE.UTF-8 (charmap=3DUTF-8)
Versions of packages usemod-wiki depends on:
ii apache [httpd] 1.3.33-3 versatile, high-performance HT=
TP s
ii apache-ssl [httpd] 1.3.33-3 versatile, high-performance HT=
TP s
ii apache2-mpm-prefork [httpd] 2.0.52-3 Traditional model for Apache2
ii perl [perl5] 5.8.4-6 Larry Wall's Practical Extract=
ion=20
-- no debconf information
--=20
[EMAIL PROTECTED] | http://www.df7cb.de/
--huq684BweRXVnRxX
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCEztoxa93SlhRC1oRAp/uAKDxuxsqqquwZK2pFAkvvMfZt8kuAACfQyJG
zVtf6g7FMeaeo/fWI0jRQe8=
=jBLf
-----END PGP SIGNATURE-----
--huq684BweRXVnRxX--
---------------------------------------
Received: (at 295515-close) by bugs.debian.org; 16 Feb 2005 16:53:02 +0000
>From [EMAIL PROTECTED] Wed Feb 16 08:53:02 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D1SQA-00061J-00; Wed, 16 Feb 2005 08:53:02 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D1SKp-0003xw-00; Wed, 16 Feb 2005 11:47:31 -0500
From: Christoph Berg <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#295515: fixed in usemod-wiki 1.0-6
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 16 Feb 2005 11:47:31 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Source: usemod-wiki
Source-Version: 1.0-6
We believe that the bug you reported is fixed in the latest version of
usemod-wiki, which is due to be installed in the Debian FTP archive:
usemod-wiki_1.0-6.diff.gz
to pool/main/u/usemod-wiki/usemod-wiki_1.0-6.diff.gz
usemod-wiki_1.0-6.dsc
to pool/main/u/usemod-wiki/usemod-wiki_1.0-6.dsc
usemod-wiki_1.0-6_all.deb
to pool/main/u/usemod-wiki/usemod-wiki_1.0-6_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christoph Berg <[EMAIL PROTECTED]> (supplier of updated usemod-wiki package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 16 Feb 2005 16:36:43 +0100
Source: usemod-wiki
Binary: usemod-wiki
Architecture: source all
Version: 1.0-6
Distribution: unstable
Urgency: high
Maintainer: Christoph Berg <[EMAIL PROTECTED]>
Changed-By: Christoph Berg <[EMAIL PROTECTED]>
Description:
usemod-wiki - Perl-based Wiki clone
Closes: 295515
Changes:
usemod-wiki (1.0-6) unstable; urgency=high
.
* Sanitize output, we are vulnerable to XSS in CAN-2004-1397
(Closes: #295515).
Files:
f871f9088a13762a753e2c12a354e59c 595 web optional usemod-wiki_1.0-6.dsc
a0928a301a95fcdae72d293c64d3dd42 12796 web optional usemod-wiki_1.0-6.diff.gz
5c07899428f64b0b9a4e1b289ea132be 64814 web optional usemod-wiki_1.0-6_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCE3Qe01u8mbx9AgoRAjVoAKDKQO9mUUqAmU1XsQ9+v72d3USKKgCcD0F/
acNMhMHkd3MsWpTzxx2oe7g=
=ht53
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
