[ GLSA 200609-20 ] DokuWiki: Shell command injection and Denial of Service

[GLSA]

Gentoo Linux Security Advisory

Title: DokuWiki: Shell command injection and Denial of Service (GLSA 200609-20)
Severity: high
Exploitable: remote
Date: September 28, 2006
Updated: December 13, 2006
Bug(s): #149266
ID: 200609-20

Synopsis


DokuWiki is vulnerable to shell command injection and Denial of Service
attacks when using ImageMagick.


Background


DokuWiki is a wiki targeted at developer teams, workgroups and small
companies. It does not use a database backend.


Affected Packages

Package: www-apps/dokuwiki
Vulnerable: < 20060309e
Unaffected: >= 20060309e
Architectures: All supported architectures


Description


Input validation flaws have been discovered in the image handling of
fetch.php if ImageMagick is used, which is not the default method.


Impact


A remote attacker could exploit the flaws to execute arbitrary shell
commands with the rights of the web server daemon or cause a Denial of
Service.


Workaround


There is no known workaround at this time.


Resolution


All DokuWiki users should upgrade to the latest version: