Skip Navigation

  • Home
  • Contact us
  • FAQ
  • Glossary
  • Public key
  • Sitemap
  • Cymraeg
  • What's new
CPNI - Centre for the Protection of National Infastructure

Advanced search

  • About CPNI
  • The threats
  • Security planning
  • Methods of attack
  • Protecting your assets
  • Products and services
    • CSIRTUK advisories
      • Advisories archive
    • General protective security publications
    • InfoSec briefings
    • InfoSec technical notes
    • InfoSec vulnerability disclosures
    • Good practice guidelines
    • Viewpoints
    • Information exchanges
    • Risk Management Delivery Group
  • Research
Home > Products and services > CSIRTUK advisories > Advisories archive > April 2006 > Three Gentoo Linux Security Advisories: 1. GLSA 200604-01 - MediaWiki: Cross-site scripting vulnerability 2. GLSA 200604-02 - Horde Application Framework: Remote code execution 3. GLSA 200604-03 - FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

April 2006

Three Gentoo Linux Security Advisories: 1. GLSA 200604-01 - MediaWiki: Cross-site scripting vulnerability 2. GLSA 200604-02 - Horde Application Framework: Remote code execution 3. GLSA 200604-03 - FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

ID: 00267
Ref: 266/2006
Date: 05 April 2006:14:48:08
Version: 1
Title: Three Gentoo Linux Security Advisories: 1. GLSA 200604-01 - MediaWiki: Cross-site scripting vulnerability 2. GLSA 200604-02 - Horde Application Framework: Remote code execution 3. GLSA 200604-03 - FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module
Abstract:
Vendors affected: Gentoo
Operating systems affected: Gentoo
Applications affected: Gentoo
Title
=====

Three Gentoo Linux Security Advisories:

1. GLSA 200604-01 - MediaWiki: Cross-site scripting vulnerability

2. GLSA 200604-02 - Horde Application Framework: Remote code execution

3. GLSA 200604-03 - FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module

Detail
======

1. MediaWiki fails to decode certain encoded URLs correctly.

2. Jan Schneider of the Horde team discovered a vulnerability in the help
viewer of the Horde Application Framework that could allow remote code
execution (CVE-2006-1491). Paul Craig reported that "services/go.php"
fails to validate the passed URL parameter correctly (CVE-2006-1260).

3. FreeRADIUS suffers from insufficient input validation in the
EAP-MSCHAPv2 state machine.




1.




- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200604-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: MediaWiki: Cross-site scripting vulnerability
Date: April 04, 2006
Bugs: #127971
ID: 200604-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

MediaWiki is vulnerable to a cross-site scripting attack that could
allow arbitrary JavaScript code execution.

Background
==========

MediaWiki is a collaborative editing software, used by big projects
like Wikipedia.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/mediawiki < 1.4.15 >= 1.4.15

Description
===========

MediaWiki fails to decode certain encoded URLs correctly.

Impact
======

By supplying specially crafted links, a remote attacker could exploit
this vulnerability to inject malicious HTML or JavaScript code that
will be executed in a user's browser session in the context of the
vulnerable site.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All MediaWiki users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/mediawiki-1.4.15"

References
==========

[ 1 ] CVE-2006-1498
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1498
[ 2 ] MediaWiki 1.4.15 Release Notes
http://sourceforge.net/project/shownotes.php?release_id=404869

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200604-01.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



2.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200604-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: Horde Application Framework: Remote code execution
Date: April 04, 2006
Bugs: #127889, #126435
ID: 200604-02

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The help viewer of the Horde Framework allows attackers to execute
arbitrary remote code.

Background
==========

The Horde Application Framework is a general-purpose web application
framework written in PHP, providing classes for handling preferences,
compression, browser detection, connection tracking, MIME and more.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-apps/horde < 3.1.1 >= 3.1.1

Description
===========

Jan Schneider of the Horde team discovered a vulnerability in the help
viewer of the Horde Application Framework that could allow remote code
execution (CVE-2006-1491). Paul Craig reported that "services/go.php"
fails to validate the passed URL parameter correctly (CVE-2006-1260).

Impact
======

An attacker could exploit the vulnerability in the help viewer to
execute arbitrary code with the privileges of the web server user. By
embedding a NULL character in the URL parameter, an attacker could
exploit the input validation issue in go.php to read arbitrary files.

Workaround
==========

There are no known workarounds at this time.

Resolution
==========

All Horde Application Framework users should upgrade to the latest
version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-3.1.1"

References
==========

[ 1 ] CVE-2006-1260
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1260
[ 2 ] CVE-2006-1491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1491
[ 3 ] Horde Announcement
http://lists.horde.org/archives/announce/2006/000271.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200604-02.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



3.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200604-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: FreeRADIUS: Authentication bypass in EAP-MSCHAPv2 module
Date: April 04, 2006
Bugs: #127229
ID: 200604-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The EAP-MSCHAPv2 module of FreeRADIUS is affected by a validation issue
which causes some authentication checks to be bypassed.

Background
==========

FreeRADIUS is an open source RADIUS authentication server
implementation.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-dialup/freeradius < 1.1.1 >= 1.1.1
< 1.0.0

Description
===========

FreeRADIUS suffers from insufficient input validation in the
EAP-MSCHAPv2 state machine.

Impact
======

An attacker could cause the server to bypass authentication checks by
manipulating the EAP-MSCHAPv2 client state machine.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All FreeRADIUS users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dialup/freeradius-1.1.1"

References
==========

[ 1 ] CVE-2006-1354
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1354
[ 2 ] FreeRADIUS Vulnerability Notifications
http://www.freeradius.org/security.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200604-03.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

  • Accessibility |
  • Terms and conditions |
  • Privacy statement |
  • Data protection act |
  • Freedom of information |