Bug 667199 (CVE-2011-0003)

Summary:	CVE-2011-0003 mediawiki: clickjacking vulnerability
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	axel.thimm, wnefal+redhatbugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-05-08 17:35:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	667201
Bug Blocks:

Description Vincent Danen 2011-01-04 19:19:59 UTC

A clickjacking vulnerability was reported in MediaWiki [1].  This could allow a malicious web site to compromise the account of the user visiting a MediaWiki-based web site (an attack similar to cross-site scripting).  For full protection, a user needs to be using a browser that supports the X-Frame-Options feature [2].

MediaWiki 1.16.1 [3] has been released to correct this flaw.  For MediaWiki 1.15.x and earlier, a patch [4] is available which denies all framing.

[1] https://bugzilla.wikimedia.org/show_bug.cgi?id=26561
[2] https://developer.mozilla.org/en/the_x-frame-options_response_header
[3] http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_16_1/phase3/RELEASE-NOTES
[4] http://www.mediawiki.org/wiki/Special:Code/MediaWiki/79566

This issue affects MediaWiki as provided in all supported versions of Fedora and EPEL5.

Comment 1 Vincent Danen 2011-01-04 19:21:47 UTC

Created mediawiki tracking bugs for this issue

Affects: fedora-all [bug 667201]

Comment 2 Vincent Danen 2011-01-04 19:27:16 UTC

Created mediawiki tracking bugs for this issue

Affects: epel-5 [bug 667202]