漏洞信息详情

ikiwiki teximg插件 黑名单不完全漏洞

• CNNVD编号：CNNVD-200908-484
• 危害等级： 中危
  
• CVE编号： CVE-2009-2944
• 漏洞类型： 其他
• 发布时间： 2009-08-31
• 威胁类型： 远程
• 更新时间： 2009-09-04
• 厂        商： ikiwiki
• 漏洞来源： Josh Triplett※ jos...

漏洞简介

Ikiwiki是软件开发者Joey和其他贡献者共同开发的一款wiki编译器，它支持将wiki页面转换为网站发布的HTML页面。 Ikiwiki的teximg插件存在黑名单不安全漏洞。由于没有正确地将不安全的TeX命令加入到黑名单，本地攻击者可以使用这个命令读取系统上的任意文件内容。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： Debian Linux 5.0 hppa Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 ia-64 Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 m68k Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 arm Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 armel Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 alpha Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 amd64 Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb ikiwiki ikiwiki 3.141592 ikiwiki ikiwiki_3.1415926.tar.gz http://ftp.de.debian.org/debian/pool/main/i/ikiwiki/ikiwiki_3.1415926. tar.gz Debian Linux 5.0 ia-32 Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 mips Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 s/390 Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 mipsel Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 powerpc Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb Debian Linux 5.0 sparc Debian ikiwiki_2.53.4_all.deb http://security.debian.org/pool/updates/main/i/ikiwiki/ikiwiki_2.53.4_ all.deb

参考网址

来源: VUPEN 名称: ADV-2009-2475 链接:http://www.vupen.com/english/advisories/2009/2475 来源: BID 名称: 36181 链接:http://www.securityfocus.com/bid/36181 来源: XF 名称: ikiwiki-teximg-info-disclosure(52922) 链接:http://xforce.iss.net/xforce/xfdb/52922 来源: SECUNIA 名称: 36516 链接:http://secunia.com/advisories/36516 来源: ikiwiki.info 链接:http://ikiwiki.info/security/#index35h2

受影响实体

• Ikiwiki Ikiwiki:2.52  
• Ikiwiki Ikiwiki:2.51  
• Ikiwiki Ikiwiki:2.50  
• Ikiwiki Ikiwiki:2.49  
• Ikiwiki Ikiwiki:2.48  

补丁

暂无