ID: IRCNE2014022087
Date: 2014-02-01
According to “ZDNet”, The WikiMedia Foundation, authors of the MediaWiki software used by Wikipedia and many other sites, Have issued a fix for a critical, remote code execution vulnerability in that program. The bug was reported to them recently by Check Point Software. This vulnerability affects all versions of MediaWiki from 1.8 onwards as well as earlier supported versions prior to 1.21.5 and 1.22.2.
According to the report on the bug in the WikiMedia bug database, "Shell meta characters can be passed in the page parameter to the thumb.php." This would allow any remote user to execute shell code on the MediaWiki application server.
Further internal review by WikiMedia revealed similar faulty logic in the PdfHandler extension, which could be exploited in a similar way. The vulnerability has been designated as CVE-2014-1610.
- 2