From owner-freebsd-ports-bugs@FreeBSD.ORG Wed Sep 5 14:10:02 2012
Return-Path: <owner-freebsd-ports-bugs@FreeBSD.ORG>
Delivered-To: freebsd-ports-bugs@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id B7C80106564A
for <freebsd-ports-bugs@hub.freebsd.org>;
Wed, 5 Sep 2012 14:10:02 +0000 (UTC)
(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
[IPv6:2001:4f8:fff6::28])
by mx1.freebsd.org (Postfix) with ESMTP id 8AECF8FC14
for <freebsd-ports-bugs@hub.freebsd.org>;
Wed, 5 Sep 2012 14:10:02 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q85EA2XI031598
for <freebsd-ports-bugs@freefall.freebsd.org>;
Wed, 5 Sep 2012 14:10:02 GMT
(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q85EA2sX031585;
Wed, 5 Sep 2012 14:10:02 GMT (envelope-from gnats)
Resent-Date: Wed, 5 Sep 2012 14:10:02 GMT
Resent-Message-Id: <201209051410.q85EA2sX031585@freefall.freebsd.org>
Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer)
Resent-To: freebsd-ports-bugs@FreeBSD.org
Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org,
Eygene Ryabinkin <rea@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
by hub.freebsd.org (Postfix) with ESMTP id 479C01065677
for <FreeBSD-gnats-submit@freebsd.org>;
Wed, 5 Sep 2012 14:00:31 +0000 (UTC) (envelope-from rea@codelabs.ru)
Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.6.71])
by mx1.freebsd.org (Postfix) with ESMTP id EB30E8FC15
for <FreeBSD-gnats-submit@freebsd.org>;
Wed, 5 Sep 2012 14:00:30 +0000 (UTC)
Received: from void.codelabs.ru (void.codelabs.ru [144.206.6.66])
by 0.mx.codelabs.ru with esmtps (TLSv1:DHE-RSA-AES256-SHA:256)
id 1T9G9d-000PrW-3m for FreeBSD-gnats-submit@freebsd.org;
Wed, 05 Sep 2012 18:00:30 +0400
Message-Id: <20120905140028.951FEDA81F@void.codelabs.ru>
Date: Wed, 5 Sep 2012 18:00:28 +0400 (MSK)
From: Eygene Ryabinkin <rea@FreeBSD.org>
To: FreeBSD-gnats-submit@FreeBSD.org
X-Send-Pr-Version: 3.113
Cc:
Subject: ports/171346: [vuln][patch] www/moinmoin: fix CVE-2012-4404
X-BeenThere: freebsd-ports-bugs@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Eygene Ryabinkin <rea@FreeBSD.org>
List-Id: Ports bug reports <freebsd-ports-bugs.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>,
<mailto:freebsd-ports-bugs-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ports-bugs>
List-Post: <mailto:freebsd-ports-bugs@freebsd.org>
List-Help: <mailto:freebsd-ports-bugs-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ports-bugs>,
<mailto:freebsd-ports-bugs-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Sep 2012 14:10:02 -0000
>Number: 171346
>Category: ports
>Synopsis: [vuln][patch] www/moinmoin: fix CVE-2012-4404
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Wed Sep 05 14:10:02 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: Eygene Ryabinkin
>Release: FreeBSD 10.0-CURRENT amd64
>Organization:
Code Labs
>Environment:
System: FreeBSD 10.0-CURRENT amd64
>Description:
Vulnerability affecting MoinMoin 1.9 up to (and including) 1.9.4 was
recently found and fixed:
http://www.vuxml.org/freebsd/4f99e2ef-f725-11e1-8bd8-0022156e8794.html
http://hg.moinmo.in/moin/1.9/rev/7b9f39289e16
>How-To-Repeat:
Look at the above URLs. Try to create the group with "All" string in
its name, restrict page's access rights like
{{{
#acl AllGoodPersonsGroup:read all:
}}}
and visit the page under user who isn't in the AllGoodPersonsGroup. The
page should be visible to that user.
>Fix:
The patch at
http://codelabs.ru/fbsd/ports/moinmoin/1.9.4-fix-cve-2012-4404.diff
applies upstream fix. I had tested it at my Tinderbox and MoinMoin instance:
vulnerability was gone. QA page:
http://codelabs.ru/fbsd/ports/qa/www/moinmoin/1.9.4_1
If this fix or update to 1.9.5 will be committed, one should use
{{{
Security: http://www.vuxml.org/freebsd/4f99e2ef-f725-11e1-8bd8-0022156e8794.html
}}}
in the commit message.
>Release-Note:
>Audit-Trail:
>Unformatted: