Nessus Plugin #16403

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[GLSA-200501-12] TikiWiki: Arbitrary command execution

Family:

Gentoo Local Security Checks

Category:

infos

Copyright:

(C) 2005 Michel Arboi

Summary:

TikiWiki: Arbitrary command execution

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

-

Xrefs:

GLSA:200501-12

Description:

The remote host is affected by the vulnerability described in GLSA-200501-12
(TikiWiki: Arbitrary command execution)


TikiWiki lacks a check on uploaded images in the Wiki edit page.

Impact

A malicious user could run arbitrary commands on the server by
uploading and calling a PHP script.

Workaround

There is no known workaround at this time.

References:
http://tikiwiki.org/tiki-read_article.php?articleId=97


Solution:
All TikiWiki users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.8.4.1"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.


Risk factor : High