Bug 890902 (CVE-2012-6081)

Summary:	CVE-2012-6081 moinmoin: remote code execution vulnerability
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	extras-orphan, imlinux+fedora, ivazqueznet, jlieskov, vpvainio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-24 16:06:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	890906, 890907
Bug Blocks:

Description Huzaifa S. Sidhpurwala 2012-12-31 04:14:09 UTC

A  remote code execution vulnerability was found in MoinMoin wiki, versions 1.9.x up to (and including) 1.9.5. The method save in class
AnyWikiDraw (action/anywikidraw.py) and class TWikiDraw (action/twikidraw.py) do not filter user supplied input correctly, which leads to a path traversal vulnerability, which can be exploited to execute arbitrary code with moin's privileges. An exploit was seen in the wild.

Details can be found at: http://moinmo.in/SecurityFixes

A fix is available at: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f 

Reference:
http://seclists.org/oss-sec/2012/q4/522

This issue has been assigned CVE-2012-6081

Comment 1 Huzaifa S. Sidhpurwala 2012-12-31 04:26:35 UTC

Created moin tracking bugs for this issue

Affects: fedora-all [bug 890906]
Affects: epel-5 [bug 890907]

Comment 2 Jan Lieskovsky 2013-01-03 11:09:07 UTC

(Further) References:
---------------------
http://www.openwall.com/lists/oss-security/2012/12/29/6
http://www.openwall.com/lists/oss-security/2012/12/30/4
https://bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599
http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f
http://moinmo.in/MoinMoinRelease1.9
http://moinmo.in/SecurityFixes
http://www.debian.org/security/2012/dsa-2593
http://ubuntu.com/usn/usn-1680-1
http://www.securityfocus.com/bid/57082
http://secunia.com/advisories/51663
http://secunia.com/advisories/51676
http://secunia.com/advisories/51696

Comment 3 Fedora Update System 2013-01-20 02:56:00 UTC

moin-1.9.6-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 4 Fedora Update System 2013-01-23 01:38:33 UTC

moin-1.9.6-1.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2013-01-23 02:00:00 UTC

moin-1.9.6-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.