CVE-2014-8763 CVE-2014-8764

Debian Bug report logs - #766545
CVE-2014-8763 CVE-2014-8764

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2014-8763 CVE-2014-8764

Date: Thu, 23 Oct 2014 23:11:16 +0200

Package: dokuwiki
Severity: important
Tags: security

Hi Tanguy,
CVE-2014-8763/CVE-2014-8764 have been assigned to this:
http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication 

There was also a CVE assignment for this issue, which is
already fixed in jessie:
https://github.com/splitbrain/dokuwiki/issues/765

I don't know dokuwiki, should we fix the media manager issue in wheezy?

See http://seclists.org/oss-sec/2014/q4/361 for details on
the CVE assignments.

Cheers,
        Moritz

Message #10 received at 766545@bugs.debian.org (full text, mbox, reply):

From: Tanguy Ortolo <tanguy+debian@ortolo.eu>

To: Moritz Muehlenhoff <jmm@debian.org>, 766545@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#766545: CVE-2014-8763 CVE-2014-8764

Date: Tue, 28 Oct 2014 14:26:48 +0100

[Message part 1 (text/plain, inline)]

package dokuwiki
fixed 766545 dokuwiki/0.0.20140929.a-1
thanks

Moritz Muehlenhoff, 2014-10-23 23:11+0200:
>Hi Tanguy,
>CVE-2014-8763/CVE-2014-8764 have been assigned to this:
>http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication
>
>There was also a CVE assignment for this issue, which is
>already fixed in jessie:
>https://github.com/splitbrain/dokuwiki/issues/765

No it is not fixed in Jessie. That is, it is now, or rather, it will be 
when the version 0.0.20140929.a-1 I have just uploaded will reach 
testing.

>I don't know dokuwiki, should we fix the media manager issue in wheezy?

I do not think that only affects the media manager, but I will see to 
fix it in stable and oldstable, yes.

Librement,

-- 
 ,--.
: /` )   ن Tanguy Ortolo    <xmpp:tanguy@ortolo.eu>
| `-'    Debian Developer   <irc://irc.oftc.net/Tanguy>
 \_

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 766545@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Tanguy Ortolo <tanguy+debian@ortolo.eu>, 766545@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#766545: CVE-2014-8763 CVE-2014-8764

Date: Tue, 28 Oct 2014 16:36:30 +0100

Hi,

On Tue, Oct 28, 2014 at 02:26:48PM +0100, Tanguy Ortolo wrote:
> package dokuwiki
> fixed 766545 dokuwiki/0.0.20140929.a-1
> thanks
> 
> Moritz Muehlenhoff, 2014-10-23 23:11+0200:
> >Hi Tanguy,
> >CVE-2014-8763/CVE-2014-8764 have been assigned to this:
> >http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication
> >
> >There was also a CVE assignment for this issue, which is
> >already fixed in jessie:
> >https://github.com/splitbrain/dokuwiki/issues/765
> 
> No it is not fixed in Jessie. That is, it is now, or rather, it will be when
> the version 0.0.20140929.a-1 I have just uploaded will reach testing.

Is this right about the last one? The whole CVE assignment for all
four CVEs is at
https://marc.info/?l=oss-security&m=141347568722364&w=2 .

CVE-2014-8761 and CVE-2014-8762 seem to be assigned to issues found in
https://github.com/splitbrain/dokuwiki/issues/765 which were fixed in
the hotfix release 2014-05-05a.

Then there were two additional CVEs CVE-2014-8763 and CVE-2014-8764
which are for problems uncovered in
http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication

Regards,
Salvatore

Message #22 received at 766545@bugs.debian.org (full text, mbox, reply):

From: Emmanuel Kasper <emmanuel@libera.cc>

To: 766545@bugs.debian.org

Subject: CVE-2014-8763 CVE-2014-8764

Date: Wed, 11 Mar 2015 15:10:37 +0100

hello tanguy

I've just installed the Debian Dokuwiki package and did some research
concerning CVE-2014-8763/CVE-2014-8764

I have read againg the message of the initial upstream reporter of the
issue
(http://www.freelists.org/post/dokuwiki/Fwd-Dokuwiki-maybe-security-issue-Null-byte-poisoning-in-LDAP-authentication),
and the null string handling allowing to do the anonymous auth bind is
rather a PHP problem than a dokuwiki problem.

Now it seems that he problem has been solved in the php side since php
5.6 ( look for ldap in http://php.net/ChangeLog-5.php )

Since Jessie has PHP >= 5.6 in Jessie and Sid, that just leaves Debian
stable vulnerable to the issue, so it might not be necessary to make a
specific upload for Jessie

(I see that your package 0.0.20140929.a-1 has not propagated to Jessie
has the freeze has probably blocked it)

Message #27 received at 766545-done@bugs.debian.org (full text, mbox, reply):

From: Tanguy Ortolo <tanguy+debian@ortolo.eu>

To: Emmanuel Kasper <emmanuel@libera.cc>, 766545-done@bugs.debian.org

Subject: Re: Bug#766545: CVE-2014-8763 CVE-2014-8764

Date: Sun, 22 Mar 2015 18:20:15 +0100

[Message part 1 (text/plain, inline)]

Emmanuel Kasper, 2015-03-11 15:10+0100:
>I've just installed the Debian Dokuwiki package and did some research
>concerning CVE-2014-8763/CVE-2014-8764
>
>Now it seems that he problem has been solved in the php side since php
>5.6 ( look for ldap in http://php.net/ChangeLog-5.php )
>
>Since Jessie has PHP >= 5.6 in Jessie and Sid, that just leaves Debian
>stable vulnerable to the issue, so it might not be necessary to make a
>specific upload for Jessie

Yes, this is correct, and since this issue was already fixed in 
squeeze-lts and wheezy-security with specific uploads, that leave... no 
Debian distribution vulnerable, I am therefore closing this bug. Thanks 
for the information!

Librement,

-- 
 ,--.
: /` )   Tanguy Ortolo      <xmpp:tanguy@ortolo.eu>
| `-'    Debian Developer   <irc://irc.oftc.net/Tanguy>
 \_

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.