ikiwiki-mass-rebuild: Fix tty hijacking vulnerability by using su. (Once su's related...

[ikiwiki.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 2b387ac2322c1accdd57b9edca7c6b0f6c36c1b8..b573b5f2348a3bea028706f1af7d5433b3b0f9a7 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -22,8 +22,8 @@ this would be to limit web commits to those done by a certain user.
 
 ## other stuff to look at
 
 
 ## other stuff to look at
 

-I need to audit the git backend a bit, and have been meaning to
-see if any CRLF injection type things can be done in the CGI code.
+I have been meaning to see if any CRLF injection type things can be
+done in the CGI code.

 
 ----
 
 
 ----
 


@@ -466,11 +466,25 @@ with the comments plugin enabled. ([[!cve CVE-2011-0428]])
 
 ## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
 
 
 ## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
 

-Tango noticed that 'meta stylesheet` directives allowed anyone
+Giuseppe Bilotta noticed that 'meta stylesheet` directives allowed anyone

 who could upload a malicious stylesheet to a site to add it to a
 who could upload a malicious stylesheet to a site to add it to a

-page as an alternate stylesheet. In order to be exploited, the user
-would have to select the alternative stylesheet in their browser.
+page as an alternate stylesheet, or replacing the default stylesheet.

 
 This hole was discovered on 28 Mar 2011 and fixed the same hour with
 
 This hole was discovered on 28 Mar 2011 and fixed the same hour with

-the release of ikiwiki 3.20110328. An upgrade is recommended for sites
-that have untrusted committers, or have the attachments plugin enabled.
+the release of ikiwiki 3.20110328. A fix was backported to Debian squeeze,
+as version 3.20100815.6. An upgrade is recommended for sites that have
+untrusted committers, or have the attachments plugin enabled.
+([[!cve CVE-2011-1401]])
+
+## tty hijacking via ikiwiki-mass-rebuild
+
+Ludwig Nussel discovered a way for users to hijack root's tty when
+ikiwiki-mass-rebuild was run. Additionally, there was some potential
+for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
+
+This hole was disconvered on 8 June 2011 and fixed the same day with
+the release of ikiwiki 3.20110608. Note that the fix is dependant on
+a version of su that has a similar hole fixed; [[!debbug 628843]]
+tracks fixing the hole in Debian's su. An upgrade is a must for any
+sites that have `ikiwiki-update-wikilist` installed suid (not the default),
+and whose admins run `ikiwiki-mass-rebuild`.