MediaWiki Multiple Security Vulnerabilities

Bugtraq ID:	65003
Class:	Input Validation Error
CVE:	CVE-2013-6451 CVE-2013-6452 CVE-2013-6453 CVE-2013-6454 CVE-2013-6472 CVE-2013-4574 CVE-2013-4570 CVE-2013-4571 CVE-2013-6455
Remote:	Yes
Local:	No
Published:	Jan 14 2014 12:00AM
Updated:	Apr 13 2015 10:12PM
Credit:	Chris from RationalWiki, Michael M, Bawolff, Eran Roz, Ravindra Singh Rathore and the vendor.
Vulnerable:	MediaWiki Mediawiki 1.21.3 MediaWiki Mediawiki 1.21.2 MediaWiki Mediawiki 1.21.1 MediaWiki Mediawiki 1.19.9 MediaWiki Mediawiki 1.19.8 MediaWiki Mediawiki 1.19.7 MediaWiki Mediawiki 1.19.6 MediaWiki Mediawiki 1.19.5 MediaWiki Mediawiki 1.19.4 MediaWiki Mediawiki 1.19.3 MediaWiki Mediawiki 1.19.2 MediaWiki Mediawiki 1.19.1 MediaWiki Mediawiki 1.19 MediaWiki Mediawiki 1.22.0 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	MediaWiki Mediawiki 1.21.4 MediaWiki Mediawiki 1.19.10 MediaWiki Mediawiki 1.22.1

MediaWiki Multiple Security Vulnerabilities

MediaWiki is prone to the following security vulnerabilities:

1. Multiple cross-site scripting vulnerabilities
2. Multiple information-disclosure vulnerabilities
3. Multiple security-bypass vulnerabilities
4. An HTML-injection vulnerability
5. A denial-of-service vulnerability
6. A buffer-overflow vulnerability
7. A cross-site request forgery vulnerability

An attacker can exploit these issues to perform unauthorized actions, bypass security restrictions, cause denial-of-service conditions, execute attacker-supplied HTML or JavaScript code in the context of the affected site, to steal cookie-based authentication credentials, execute arbitrary code, or gain access to sensitive information.

Versions prior to MediaWiki 1.19.20, 1.21.4 and 1.22.1 are vulnerable.

MediaWiki Multiple Security Vulnerabilities

Attackers can exploit this issue using a browser or readily available tools.

MediaWiki Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Mandriva Business Server 1 X86 64

• Mandriva mediawiki-1.22.3-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-ldapauthentication-2.0f-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-mysql-1.22.3-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-pgsql-1.22.3-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva mediawiki-sqlite-1.22.3-1.mbs1.noarch.rpm
  http://www.mandriva.com/en/downloads/

MediaWiki Multiple Security Vulnerabilities

References:

• [MediaWiki-announce] MediaWiki Security Releases: 1.22.1, 1.21.4 and 1.19.10 (MediaWiki)
  
• Bug 49705 - Buffer overflow in luasandbox php extension (mediawiki/php/luasandbo (MediaWiki)
  
• Bug 54527 - NULL pointer dereference in php-luasandbox (MediaWiki)
  
• Bug 56699 - TimedMediaHandler allows for stored XSS (MediaWiki)
  
• Bug 57025 - Add CSRF checks to Special:CreateCategory (MediaWiki)
  
• Bug 57081 - Privacy: User names shouldn't be exposed outside domain (CentralAuth (MediaWiki)
  
• Bug 57550 - SVG XSLT XSS (MediaWiki)
  
• Bug 58088 - [Regression] Sanitizer::checkCss blacklist can be bypassed using ful (MediaWiki)
  
• Bug 58472 - Opera 12 -o-link XSS (user interaction required) (MediaWiki)
  
• Bug 58553 - Invalid xml accepted by svg upload (MediaWiki)
  
• Bug 58699 - RevDeled log entry information leaks (MediaWiki)
  
• MediaWiki Homepage (MediaWiki)