Bug 443949 (CVE-2008-6603) - CVE-2008-6603 moin: incorrect processing of hierarchic ACLs
Summary: CVE-2008-6603 moin: incorrect processing of hierarchic ACLs
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-6603
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-04-24 09:50 UTC by Tomas Hoger
Modified: 2019-09-29 12:24 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2009-04-16 07:56:50 UTC
Embargoed:

Attachments (Terms of Use)

Description Tomas Hoger 2008-04-24 09:50:40 UTC 
Upstream MoinMoin version 1.6.3 fixed an issue with processing of hierarchic
ACLs.  Real security implications seems unclear from upstream notes.

References:
http://moinmo.in/SecurityFixes
http://moinmo.in/MoinMoinBugs/AclHierarchicPageAclSupercededByAclRightsAfter

Upstream fix:
http://hg.moinmo.in/moin/1.6/rev/543ae9bdbe26
http://hg.moinmo.in/moin/1.7/rev/88356b3f849a
Comment 1 Tomas Hoger 2008-04-24 09:51:32 UTC 
From moin 1.6.3 changelog:

    * Security fix: if acl_hierarchic=True was used (False is the default),
      ACL processing was wrong for some cases, see
      MoinMoinBugs/AclHierarchicPageAclSupercededByAclRightsAfter
Comment 2 Tomas Hoger 2008-04-24 09:56:28 UTC 
Matthias, do you know if this affects 1.5.x as well?
Comment 3 Tomas Hoger 2009-04-06 06:56:26 UTC 
CVE-2008-6603:
MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when
acl_hierarchic is set to True, which might allow remote attackers to
bypass intended access restrictions, a different vulnerability than
CVE-2008-1937.
Comment 4 Ville-Pekka Vainio 2009-04-16 07:47:24 UTC 
(In reply to comment #2)
> Matthias, do you know if this affects 1.5.x as well?  

Replying as I'm the new moin maintainer. There are no hierarchic ACLs in 1.5 which means EL-4 and EL-5 with 1.5.9 shouldn't be affected.
Comment 5 Ville-Pekka Vainio 2009-04-16 07:54:57 UTC 
And F-9 and F-9 already have 1.6.3, so this should be fixed there.
Comment 6 Tomas Hoger 2009-04-16 07:56:50 UTC 
Yeah, thank you!
Note You need to log in before you can comment on or make changes to this bug.