TDiary Cross-Site Request Forgery Vulnerability

Bugtraq ID:	14500
Class:	Design Error
CVE:	CVE-2005-2411
Remote:	Yes
Local:	No
Published:	Aug 08 2005 12:00AM
Updated:	Jul 12 2009 04:06PM
Credit:	Discovery is credited to Yutaka OIWA and Hiromitsu TAKAGI.
Vulnerable:	tDiary tDiary 2.1.1 tDiary tDiary 2.0.1 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1
Not Vulnerable:	tDiary tDiary 2.1.2 tDiary tDiary 2.0.2

TDiary Cross-Site Request Forgery Vulnerability

tDiary is prone to a cross-site request forgery vulnerability. This issue may allow a remote attacker to delete data and configuration settings and potentially execute commands on an affected computer.

tDiary 2.0.1 and prior and tDiary 2.1.1 are affected by this issue.

TDiary Cross-Site Request Forgery Vulnerability

An exploit is not required.

TDiary Cross-Site Request Forgery Vulnerability

Solution:
The vendor has released tDiary versions 2.0.2 and 2.1.2 to address this issue.

Debian Linux has released security advisory DSA 808-1 addressing this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.


tDiary tDiary 2.0.1

• tDiary tdiary-full-2.0.2.tar.gz
  http://prdownloads.sourceforge.net/tdiary/tdiary-full-2.0.2.tar.gz?dow nload

tDiary tDiary 2.1.1

• tDiary tdiary-full-2.1.2.tar.gz
  http://prdownloads.sourceforge.net/tdiary/tdiary-full-2.1.2.tar.gz?dow nload

TDiary Cross-Site Request Forgery Vulnerability

References:

• Vendor Homepage (tDiary)