security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.

It was discovered that MoinMoin did not properly sanitize certain input, resulting in a cross-site scripting (XSS) vulnerability. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2011-1058)

It was discovered that MoinMoin incorrectly handled group names that contain virtual group names such as 'All', 'Known' or 'Trusted'. This could result in a remote user having incorrect permissions.
(CVE-2012-4404).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2012-4404

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Moin, a Python clone of WikiWiki, incorrectly evaluates ACLs when virtual groups are involved. This may allow certain users to have additional permissions (privilege escalation) or lack expected permissions.

MoinMoin developers report :

If you have group NAMES containing 'All' or 'Known' or 'Trusted', they behaved wrong until now (they erroneously included All/Known/Trusted users even if you did not list them as members), but will start working correctly with this changeset.

E.g. AllFriendsGroup :

- JoeDoe

AllFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all users (including JoeDoe) before.

E.g. MyTrustedFriendsGroup :

- JoeDoe

MyTrustedFriendsGroup will now (correctly) include only JoeDoe. It (erroneously) contained all trusted users and JoeDoe before.

ID	Name	Product	Family	Severity
62511	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : moin vulnerabilities (USN-1604-1)	Nessus	Ubuntu Local Security Checks	medium
62159	Fedora 18 : moin-1.9.4-3.fc18 (2012-13528)	Nessus	Fedora Local Security Checks	medium
62151	Fedora 17 : moin-1.9.4-3.fc17 (2012-13408)	Nessus	Fedora Local Security Checks	medium
62150	Fedora 16 : moin-1.9.4-3.fc16 (2012-13400)	Nessus	Fedora Local Security Checks	medium
61792	Debian DSA-2538-1 : moin - privilege escalation	Nessus	Debian Local Security Checks	medium
61781	FreeBSD : moinmoin -- wrong processing of group membership (4f99e2ef-f725-11e1-8bd8-0022156e8794)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-4404

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium