full-disclosure - Tikiwiki 1.9.8 exploit ITW

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <470E9386.7070709@moritz-naumann.com>
Date: Thu, 11 Oct 2007 23:20:06 +0200
From: Moritz Naumann <security@...itz-naumann.com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>, 
	bugtraq@...urityfocus.com
Subject: Tikiwiki 1.9.8 exploit ITW

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

there's a tikiwiki (tikiwiki.org) remote code execution exploit in the
wild, targetting v.1.9.8 and earlier. This vulnerability is being
exploited by multiple hosts (likely a botnet) using multiple payload
websites since at least Tue 08:00 PM UTC to gain access to several
users' hotmail accounts.

Disabling url_fopen() or denying access to tiki-graph_formula.php for
unauthenticated users will prevent your site from being exploited.

I've notified the developers.

If, what it says on http://dev.tikiwiki.org/Security is up to date (i.e.
unfixed security issues of high priority initially reported 9 months
ago), then you really should not use this software.

Moritz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHDpOGn6GkvSd/BgwRCsWxAJ9bTbidmQne58/L+KmMKRM9+qK5PgCgl+Q7
e5sorw+ecp/4TO4YydX5FxA=
=0mUm
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/