- Hpc-admins - mailman3.cels.anl.gov

Re: [HPC-Admins] [CELS Sysadmins] [mcs-internal #23315] [Fwd: [MediaWiki-announce] MediaWiki 1.13.3, 1.12.2, 1.6.11 security update]
by Kenneth Raffenetti 28 Jan '09

28 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This upgrade was actually quite a bit easier than I anticipated. Since there were no database updates, I just need to update the core wiki code. This is done. Please report any wiki issues to systems(a)mcs.anl.gov Ken Kenneth Raffenetti wrote: > Hi all, > > So it appears I copied the wrong list on this the first time around, so > here it goes again. > > I want to apply these Mediawiki updates next Wednesday (1/28) @ 5pm. I > estimate an outage of about an hour for all MCS and ALCF wikis. Are > there any objections to the time? > > Ken > > Kenneth Raffenetti wrote: >> Making a reminded to apply security patches to Mediawiki. > >> Ken > > ------------------------------------------------------------------------ > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11. > Some of the security issues affect *all* versions of MediaWiki except > the versions released today, so all site administrators are encouraged > to upgrade. > > Users of the development (trunk) branch should upgrade to r44506 or later. > > David Remahl of Apple's Product Security team has identified a number > of security issues in MediaWiki. Subsequent analysis by the MediaWiki > development team led to further discoveries. The issues with a > significant impact are as follows: > > * An XSS vulnerability affecting all MediaWiki installations between > 1.13.0 and 1.13.2. [CVE-2008-5249] > * A local script injection vulnerability affecting Internet Explorer > clients for all MediaWiki installations with uploads enabled. > [CVE-2008-5250] > * A local script injection vulnerability affecting clients with SVG > scripting capability (such as Firefox 1.5+), for all MediaWiki > installations with SVG uploads enabled. [CVE-2008-5250] > * A CSRF vulnerability affecting the Special:Import feature, for all > MediaWiki installations since the feature was introduced in 1.3.0. > [CVE-2008-5252] > > These four vulnerabilities are all fixed in these releases. > > XSS (cross-site scripting) vulnerabilities allow an attacker to steal > an authorised user's login session, and to act as that user on the > wiki. The authorised user must visit a web page controlled by the > attacker in order to activate the attack. Intranet wikis are > vulnerable if the attacker can determine the intranet URL. > > Local script injection vulnerabilities are like XSS vulnerabilities, > except that the attacker must have an account on the local wiki, and > there is no external site involved. The attacker uploads a script to > the wiki, which another user is tricked into executing, with the > effect that the attacker is able to act as the privileged user. > > CSRF vulnerabilities allow an attacker to act as an authorised user on > the wiki, but unlike an XSS vulnerability, the attacker can only act > as the user in a specific and restricted way. The present CSRF > vulnerability allows pages to be edited, with forged revision > histories. Like an XSS vulnerability, the authorised user must visit > the malicious web page to activate the attack. > > David Remahl also reminded us of some security-related configuration > issues: > > * Since 1.11, by default, MediaWiki stores a backup of deleted images > in the images/deleted > directory. If you do not want these images to be publically > accessible, make > sure this directory is not accessible from the web. MediaWiki takes > some steps > to avoid leaking these images, but these measures are not perfect. > * Set display_errors=off in your php.ini to avoid path disclosure via > PHP fatal > errors. This is the default on most shared web hosts. > * Enabling MediaWiki's debugging features, such as > $wgShowExceptionDetails, may > lead to path disclosure. > > Users of MediaWiki 1.6.x (the last branch which supported PHP 4) are > strongly recommended to upgrade to PHP 5 and MediaWiki 1.13.3. It is > not necessary to upgrade to 1.6.11 first, just upgrade directly to the > latest version. > > Upgrade FAQ: > http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading > > Full release notes: > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_3/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_2/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_11/phase3/RELEASE-NO… > > > ********************************************************************** > MEDIAWIKI 1.13.3 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz > > Patch to previous version (1.13.2), without interface text: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.12.2 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz > > Patch to previous version (1.12.1), without interface text: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.6.11 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz > > Patch to previous version (1.6.10): > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz.sig > > Public keys: > https://secure.wikimedia.org/keys.html > > - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkmA5okACgkQvRJB9CBtvwjazACghwjG4BPVljMsXrBPBOj5xq88 4Z4An1s1i3yxaHBrkj3jbk+/M0BX7M6x =qyEz -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Re: [HPC-Admins] [CELS Sysadmins] [mcs-internal #23315] [Fwd: [MediaWiki-announce] MediaWiki 1.13.3, 1.12.2, 1.6.11 security update]
by Kenneth Raffenetti 27 Jan '09

27 Jan '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Just a reminder that I'm still planning to do this upgrade tomorrow. Here is the list of wikis that will be affected by the approximate 1 hour of downtime. bionet.mcs.anl.gov cgat-wiki.mcs.anl.gov dev.globus.org igsb-core.mcs.anl.gov nek5000.mcs.anl.gov water.cogkit.org wiki.cogkit.org wiki.globus.org wiki.igsb.org wiki-internal.igsb.org wiki.iwire.org wiki.lcrc.anl.gov wiki.mcs.anl.gov wiki.alcf.anl.gov wiki-internal.alcf.anl.gov Please let me know before 5pm tomorrow if this will be a problem. Thanks, Ken Kenneth Raffenetti wrote: > Hi all, > > So it appears I copied the wrong list on this the first time around, so > here it goes again. > > I want to apply these Mediawiki updates next Wednesday (1/28) @ 5pm. I > estimate an outage of about an hour for all MCS and ALCF wikis. Are > there any objections to the time? > > Ken > > Kenneth Raffenetti wrote: >> Making a reminded to apply security patches to Mediawiki. > >> Ken > > ------------------------------------------------------------------------ > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > This is a security release of MediaWiki 1.13.3, 1.12.1 and 1.6.11. > Some of the security issues affect *all* versions of MediaWiki except > the versions released today, so all site administrators are encouraged > to upgrade. > > Users of the development (trunk) branch should upgrade to r44506 or later. > > David Remahl of Apple's Product Security team has identified a number > of security issues in MediaWiki. Subsequent analysis by the MediaWiki > development team led to further discoveries. The issues with a > significant impact are as follows: > > * An XSS vulnerability affecting all MediaWiki installations between > 1.13.0 and 1.13.2. [CVE-2008-5249] > * A local script injection vulnerability affecting Internet Explorer > clients for all MediaWiki installations with uploads enabled. > [CVE-2008-5250] > * A local script injection vulnerability affecting clients with SVG > scripting capability (such as Firefox 1.5+), for all MediaWiki > installations with SVG uploads enabled. [CVE-2008-5250] > * A CSRF vulnerability affecting the Special:Import feature, for all > MediaWiki installations since the feature was introduced in 1.3.0. > [CVE-2008-5252] > > These four vulnerabilities are all fixed in these releases. > > XSS (cross-site scripting) vulnerabilities allow an attacker to steal > an authorised user's login session, and to act as that user on the > wiki. The authorised user must visit a web page controlled by the > attacker in order to activate the attack. Intranet wikis are > vulnerable if the attacker can determine the intranet URL. > > Local script injection vulnerabilities are like XSS vulnerabilities, > except that the attacker must have an account on the local wiki, and > there is no external site involved. The attacker uploads a script to > the wiki, which another user is tricked into executing, with the > effect that the attacker is able to act as the privileged user. > > CSRF vulnerabilities allow an attacker to act as an authorised user on > the wiki, but unlike an XSS vulnerability, the attacker can only act > as the user in a specific and restricted way. The present CSRF > vulnerability allows pages to be edited, with forged revision > histories. Like an XSS vulnerability, the authorised user must visit > the malicious web page to activate the attack. > > David Remahl also reminded us of some security-related configuration > issues: > > * Since 1.11, by default, MediaWiki stores a backup of deleted images > in the images/deleted > directory. If you do not want these images to be publically > accessible, make > sure this directory is not accessible from the web. MediaWiki takes > some steps > to avoid leaking these images, but these measures are not perfect. > * Set display_errors=off in your php.ini to avoid path disclosure via > PHP fatal > errors. This is the default on most shared web hosts. > * Enabling MediaWiki's debugging features, such as > $wgShowExceptionDetails, may > lead to path disclosure. > > Users of MediaWiki 1.6.x (the last branch which supported PHP 4) are > strongly recommended to upgrade to PHP 5 and MediaWiki 1.13.3. It is > not necessary to upgrade to 1.6.11 first, just upgrade directly to the > latest version. > > Upgrade FAQ: > http://www.mediawiki.org/wiki/Manual:FAQ#Upgrading > > Full release notes: > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_13_3/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_12_2/phase3/RELEASE-NO… > http://svn.wikimedia.org/svnroot/mediawiki/tags/REL1_6_11/phase3/RELEASE-NO… > > > ********************************************************************** > MEDIAWIKI 1.13.3 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz > > Patch to previous version (1.13.2), without interface text: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-1.13.3.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.13/mediawiki-i18n-1.13.3.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.12.2 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz > > Patch to previous version (1.12.1), without interface text: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz > Interface text changes: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-1.12.2.patch.gz.sig > http://download.wikimedia.org/mediawiki/1.12/mediawiki-i18n-1.12.2.patch.gz… > > Public keys: > https://secure.wikimedia.org/keys.html > > ********************************************************************** > MEDIAWIKI 1.6.11 > ********************************************************************** > Download: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz > > Patch to previous version (1.6.10): > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz > > GPG signatures: > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.tar.gz.sig > http://download.wikimedia.org/mediawiki/1.6/mediawiki-1.6.11.patch.gz.sig > > Public keys: > https://secure.wikimedia.org/keys.html > > - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkl/mvwACgkQvRJB9CBtvwhriACgrMCGo69YaUg7JzD5tkWYuXlt KlMAnRMKpcW1OqmWwfHWkSg77+CPv6a6 =6/3k -----END PGP SIGNATURE----- _______________________________________________ This is the CELS Sysadmins mailing list. It is sent to memebers of: core-admins(a)mcs.anl.gov, hpc-admins(a)mcs.anl.gov, systems(a)alcf.anl.gov, aig(a)alcf.anl.gov. Do not subscribe directly to this list. Thanks.

1 0

Fargo Brazilian Jiu-jitsu Academy taken 2009 by storm!
by Fargo Brazilian Jiu-Jitsu 23 Jan '09

23 Jan '09

1 0

Fargo Brazilian Jiu-jitsu Academy
by fargobjj＠yahoo.com 17 Jan '09

17 Jan '09

1 0

Reminder: Holiday party (Geek Beer Special Edition)
by Craig Stacey 18 Dec '08

18 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 If you've already RSVP'ed, great! If not, here's a reminder. > Since the divisional holiday parties never seem to happen anymore, I > needs me some festive eating and drinking to make me continue to > like working here. > > So. > > I'm going to host a party! > > Details at http://stace.com/party. Short story is Dec 19th, 7PM, > spouses, etc. welcome. We'll do food and drink and fun. > > Hope you can come! > == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAklB8HoACgkQbVNGA3HOzQsPKwCfSYQy4ibxYattOlBffQJbSxzB P1EAoKOKiB75fu9Jn0G8VEXlyq6U/s86 =/zUv -----END PGP SIGNATURE-----

1 1

Holiday party (Geek Beer Special Edition)
by Craig Stacey 18 Nov '08

18 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Since the divisional holiday parties never seem to happen anymore, I needs me some festive eating and drinking to make me continue to like working here. So. I'm going to host a party! Details at http://stace.com/party. Short story is Dec 19th, 7PM, spouses, etc. welcome. We'll do food and drink and fun. Hope you can come! == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkkjVCIACgkQbVNGA3HOzQumlQCfaaRU6oP5DOQGvMElVM4FLIrr eWAAnj0c4+gVD5i45/JyRLRzfqBa8y0D =kHRT -----END PGP SIGNATURE-----

1 0

New list: HPC-admins
by Craig Stacey 28 Oct '08

28 Oct '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hey, gang. Just a welcome message to the new hpc-admins list. Currently: Rick, Narayan, Hunter, Jason, Ti, JohnV, and me. If there are others you think should be on the list, by all means. I want to keep it separate from core-admins to keep the focus right here, since core-admins gets a fair amount of traffic that wouldn't be of interest to a number of people on this list. We'll also start doing meetings on some schedule or other for those who are interested. == Craig -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) iEYEARECAAYFAkkHlVsACgkQbVNGA3HOzQtlyQCghviu1X65qB5hFrVj0Q8CoSCH OQUAoJabuj89bGgRgahcHp9D3EI4kFtC =gEjr -----END PGP SIGNATURE-----

2 1