bugtraq - Re: a worm for mediaWiki??

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <44102F28.6000609@riceclan.org>
Date: Thu, 09 Mar 2006 07:35:36 -0600
From: Michael Rice <michael@...eclan.org>
To: "vitamona" <vitamona@...il.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: a worm for mediaWiki??


"vitamona" wrote:

>Hi,
>i've noticed a strange thing on MediaWiki that i used sometimes.
>The highlight word on the varius articoles on mediaWiki was replace
>with strange string like this:
>NaodW29-pre1dc0e53c28ac067d00000016
>
>For look this on google see here:
>http://www.google.com/search?hl=en&lr=&q=NaodW29&btnG=Search
>
>Is this an 0days mass exploit??
>
>Bye
>
It looks like strings starting with NaodW29 are being used internally by 
the wiki engine as part of it's normal business.  Several posts from 
Nov/Dec 2005 suggest that certain changes may have caused the wiki 
engine to expose these internal strings.  It appears, at least on the 
surface, to be a simple bug.