Multiple vulnerabilities were found in DokuWiki, the worst of which leading to privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20121013 | >= 20121013 |
DokuWiki is a simple to use Wiki aimed at a small company’s documentation needs.
Multiple vulnerabilities have been discovered in DokuWiki. Please review the CVE identifiers referenced below for details.
The vulnerabilities might allow an attacker to disclose local files, to inject arbitrary web script, or to gain elevated privileges in the DokuWiki application.
There is no known workaround at this time.
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-20121013"
An input sanitation error in DokuWiki might lead to the dislosure of local files or even the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20090214b | >= 20090214b |
DokuWiki is a standards compliant Wiki system written in PHP.
girex reported that data from the "config_cascade" parameter in inc/init.php is not properly sanitized before being used.
A remote attacker could exploit this vulnerability to execute PHP code from arbitrary local, or, when the used PHP version supports ftp:// URLs, also from remote files via FTP. Furthermore, it is possible to disclose the contents of local files. NOTE: Successful exploitation requires the PHP option "register_globals" to be enabled.
Disable "register_globals" in php.ini.
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-2009-02-14b"
DokuWiki is vulnerable to a cross-site scripting attack.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20061106 | >= 20061106 |
DokuWiki is a simple to use wiki aimed at creating documentation.
DokuWiki does not sanitize user input to the GET variable 'media' in the fetch.php file.
An attacker could entice a user to click a specially crafted link and inject CRLF characters into the variable. This would allow the creation of new lines or fields in the returned HTTP Response header, which would permit the attacker to execute arbitrary scripts in the context of the user's browser.
Replace the following line in lib/exe/fetch.php:
$MEDIA = getID('media',false); // no cleaning - maybe external
with
$MEDIA = preg_replace('/[\x00-\x1F]+/s','',getID('media',false));
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-20061106"
DokuWiki is vulnerable to shell command injection and Denial of Service attacks when using ImageMagick.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20060309e | >= 20060309e |
DokuWiki is a wiki targeted at developer teams, workgroups and small companies. It does not use a database backend.
Input validation flaws have been discovered in the image handling of fetch.php if ImageMagick is used, which is not the default method.
A remote attacker could exploit the flaws to execute arbitrary shell commands with the rights of the web server daemon or cause a Denial of Service.
There is no known workaround at this time.
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-20060309e"
Vulnerabilities in some accessory scripts of DokuWiki allow remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20060309d | >= 20060309d |
DokuWiki is a wiki targeted at developer teams, workgroups and small companies. It does not use a database backend.
"rgod" discovered that DokuWiki doesn't sanitize the X-FORWARDED-FOR HTTP header, allowing the injection of arbitrary contents - such as PHP commands - into a file. Additionally, the accessory scripts installed in the "bin" DokuWiki directory are vulnerable to directory traversal attacks, allowing to copy and execute the previously injected code.
A remote attacker may execute arbitrary PHP (and thus probably system) commands with the permissions of the user running the process serving DokuWiki pages.
Disable remote access to the "bin" subdirectory of the DokuWiki installation. Remove the directory if you don't use the scripts in there.
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-20060309d"
A flaw in DokuWiki's spell checker allows for the execution of arbitrary PHP commands, even without proper authentication.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| www-apps/dokuwiki | * | < 20060309-r1 | >= 20060309-r1 |
DokuWiki is a simple to use wiki targeted at developer teams, workgroups and small companies.
Stefan Esser discovered that the DokuWiki spell checker fails to properly sanitize PHP's "complex curly syntax".
A unauthenticated remote attacker may execute arbitrary PHP commands - and thus possibly arbitrary system commands - with the permissions of the user running the webserver that serves DokuWiki pages.
There is no known workaround at this time.
All DokuWiki users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-apps/dokuwiki-20060309-r1"