ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

Mitre reports :

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revision was made.

When CGI::FormBuilder->field('foo') is called in list context (and in particular in the arguments to a subroutine that takes named arguments), it can return zero or more values for foo from the CGI request, rather than the expected single value. This breaks the usual Perl parsing convention for named arguments, similar to CVE-2014-1572 in Bugzilla (which was caused by a similar API design issue in CGI.pm).

Several vulnerabilities have been found in ikiwiki, a wiki compiler :

CVE-2016-9646

Commit metadata forgery

CVE-2016-10026

Authorization bypass when reverting changes

CVE-2017-0356

Authentication bypass via repeated parameters

For Debian 7 'Wheezy', these problems have been fixed in version 3.20120629.2+deb7u2.

We recommend that you upgrade your ikiwiki packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to the latest stable version. See https://ikiwiki.info/news/ for the list of changes.

Security fix for CVE-2016-10026, CVE-2016-9646, CVE-2017-0356.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been found in the Ikiwiki wiki compiler :

  - CVE-2016-9646     Commit metadata forgery via CGI::FormBuilder     context-dependent APIs

  - CVE-2016-10026     Editing restriction bypass for git revert

  - CVE-2017-0356     Authentication bypass via repeated parameters

Additional details on these vulnerabilities can be found at https://ikiwiki.info/security/

ID	Name	Product	Family	Severity
97544	FreeBSD : ikiwiki -- multiple vulnerabilities (5ed094a0-0150-11e7-ae1b-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
96911	Debian DLA-812-1 : ikiwiki security update	Nessus	Debian Local Security Checks	critical
96895	Fedora 24 : ikiwiki (2017-8873ebdb43)	Nessus	Fedora Local Security Checks	critical
96848	Fedora 25 : ikiwiki (2017-c756d37779)	Nessus	Fedora Local Security Checks	critical
96462	Debian DSA-3760-1 : ikiwiki - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2016-10026

high

Tenable Plugins

high

critical

critical

critical

critical