Debian Long Term Support / LTS Security Information / 2014 / Security Information -- DLA-79-1 dokuwiki

Debian Security Advisory

DLA-79-1 dokuwiki -- LTS security update

Date Reported:

29 Oct 2014

Affected Packages:

dokuwiki

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 766545.
In Mitre's CVE dictionary: CVE-2014-8763, CVE-2014-8764.

More information:

This fixes a possibility of bypassing the wiki authentication when an Active Directory is used for LDAP authentication. These two CVE are almost the same, one apparently being a superset of the other. They are fixed together.

• CVE-2014-8763

  DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.

• CVE-2014-8764

  DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.

For Debian 6 Squeeze, these issues have been fixed in dokuwiki version 0.0.20091225c-10+squeeze3