Piwik Prior to 1.1 Multiple Security Vulnerabilities
BID:45787
Info
Piwik Prior to 1.1 Multiple Security Vulnerabilities
| Bugtraq ID: | 45787 |
| Class: | Unknown |
| CVE: |
CVE-2011-0398 CVE-2011-0399 CVE-2011-0400 CVE-2011-0401 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 12 2011 12:00AM |
| Updated: | Jan 12 2011 12:00AM |
| Credit: | vipsoft and matt |
| Vulnerable: |
Piwik Piwik 0.9.9 Piwik Piwik 0.6.4 Piwik Piwik 0.6.4 Piwik Piwik 0.6.3 Piwik Piwik 0.6.3 Piwik Piwik 0.6.2 Piwik Piwik 0.6.2 Piwik Piwik 0.6.1 Piwik Piwik 0.6.1 Piwik Piwik 0.5.5 Piwik Piwik 0.5.4 Piwik Piwik 0.5.3 Piwik Piwik 0.5.1 Piwik Piwik 0.4.5 Piwik Piwik 0.4.4 Piwik Piwik 0.4.3 Piwik Piwik 0.4.2 Piwik Piwik 0.4.1 Piwik Piwik 0.2.32 Piwik Piwik 0.2.20 Piwik Piwik 0.2.19 Piwik Piwik 0.2.18 Piwik Piwik 0.2.17 Piwik Piwik 0.2.16 Piwik Piwik 0.2.14 Piwik Piwik 0.2.13 Piwik Piwik 0.2.12 Piwik Piwik 0.2.11 Piwik Piwik 0.2.10 Piwik Piwik 0.2.9 Piwik Piwik 0.2.8 Piwik Piwik 0.2.6 Piwik Piwik 0.2.3 Piwik Piwik 0.1.10 Piwik Piwik 0.1.7 Piwik Piwik 0.1.5 Piwik Piwik 0.1.4 Piwik Piwik 0.1.3 Piwik Piwik 0.1.2 Piwik Piwik 0.1.1 Piwik Piwik 1.0 Piwik Piwik 0.9 Piwik Piwik 0.8 Piwik Piwik 0.7 Piwik Piwik 0.6.3 Rc2 Piwik Piwik 0.6.3 Rc1 Piwik Piwik 0.6 Piwik Piwik 0.5.2 Piwik Piwik 0.5 Piwik Piwik 0.4.1 Rc1 Piwik Piwik 0.4 Rc3 Piwik Piwik 0.4 Rc2 Piwik Piwik 0.4 Rc1 Piwik Piwik 0.4 Piwik Piwik 0.3 Piwik Piwik 0.2.7 Piwik Piwik 0.2.5 Piwik Piwik 0.2.4 Piwik Piwik 0.2.37 Piwik Piwik 0.2.36 Piwik Piwik 0.2.35 Piwik Piwik 0.2.34 Piwik Piwik 0.2.33 Piwik Piwik 0.2.31 Piwik Piwik 0.2.30 Piwik Piwik 0.2.29 Piwik Piwik 0.2.28 Piwik Piwik 0.2.27 Piwik Piwik 0.2.26 Piwik Piwik 0.2.25 Piwik Piwik 0.2.24 Piwik Piwik 0.2.23 Piwik Piwik 0.2.22 Piwik Piwik 0.2.2 Piwik Piwik 0.2.1 Piwik Piwik 0.1.9 Piwik Piwik 0.1.8 Piwik Piwik 0.1.6 Piwik Piwik 0.1 |
| Not Vulnerable: |
Piwik Piwik 1.1 |
Discussion
Piwik Prior to 1.1 Multiple Security Vulnerabilities
Piwik is prone to multiple security vulnerabilities including a spoofing vulnerability, a clickjacking vulnerability, a security-bypass vulnerability and a remote denial-of-service vulnerability.
An attacker can exploit these issues to cause denial-of-service conditions, effectively denying service to legitimate users, to steal cookie-based authentication credentials, to compromise the application and obtain sensitive information, or to spoof an IP address which may lead to a false sense of trust, allowing the attacker to perform malicious activities. Other attacks may also be possible.
Versions prior to Piwik 1.1 are vulnerable.
Piwik is prone to multiple security vulnerabilities including a spoofing vulnerability, a clickjacking vulnerability, a security-bypass vulnerability and a remote denial-of-service vulnerability.
An attacker can exploit these issues to cause denial-of-service conditions, effectively denying service to legitimate users, to steal cookie-based authentication credentials, to compromise the application and obtain sensitive information, or to spoof an IP address which may lead to a false sense of trust, allowing the attacker to perform malicious activities. Other attacks may also be possible.
Versions prior to Piwik 1.1 are vulnerable.
Exploit / POC
Piwik Prior to 1.1 Multiple Security Vulnerabilities
Attackers can use readily available tools to exploit these issues.
Attackers can use readily available tools to exploit these issues.
Solution / Fix
Piwik Prior to 1.1 Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Piwik Prior to 1.1 Multiple Security Vulnerabilities
References:
References:
- Piwik 1.1 release notes (Piwik)
- Piwik Homepage (Piwik)
- Check session.gc_probability so tmp/sessions files don't grow out of control (Piwik)
- Login via https should set cookie's secure flag (Piwik)
- Piwik clickjacking vulnerability (Piwik)
- Piwik_Common::getIP() - filter for public IP or from trusted proxy (Piwik)