Debian Security Advisory
DLA-79-1 dokuwiki -- LTS security update
- Date Reported:
- 29 Oct 2014
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 766545.
In Mitre's CVE dictionary: CVE-2014-8763, CVE-2014-8764.
- More information:
This fixes a possibility of bypassing the wiki authentication when an Active Directory is used for LDAP authentication. These two CVE are almost the same, one apparently being a superset of the other. They are fixed together.
DokuWiki before 2014-05-05b, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a password starting with a null (\0) character and a valid user name, which triggers an unauthenticated bind.
DokuWiki 2014-05-05a and earlier, when using Active Directory for LDAP authentication, allows remote attackers to bypass authentication via a user name and password starting with a null (\0) character, which triggers an anonymous bind.
For Debian 6
Squeeze, these issues have been fixed in dokuwiki version 0.0.20091225c-10+squeeze3