Ubuntu 12.10 USN-1680-1 Critical: MoinMoin File Overwrite Threat

ubuntu

December 30, 2012

MoinMoin could be made to run programs and overwrite files.

Summary

MoinMoin could be made to run programs and overwrite files.

Software Description:

- moin: Collaborative hypertext environment

Details:

It was discovered that MoinMoin did not properly sanitize its input when

processing AnyWikiDraw and TWikiDraw actions. A remote attacker with write

access could exploit this to overwrite arbitrary files and execute

arbitrary code with the priviliges of the web server (user 'www-data').

It was discovered that MoinMoin also did not properly sanitize its input

when processing the AttachFile action. A remote attacker could exploit

this to overwrite files via directory traversal.

Topics Covered

security advisory critical software update remote code execution file overwrite Ubuntu moin

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  python-moinmoin                 1.9.3-1ubuntu3.1

Ubuntu 12.04 LTS:
  python-moinmoin                 1.9.3-1ubuntu2.2

Ubuntu 11.10:
  python-moinmoin                 1.9.3-1ubuntu1.11.10.2

Ubuntu 10.04 LTS:
  python-moinmoin                 1.9.2-2ubuntu3.3

In general, a standard system update will make all the necessary changes.