发布时间 :2005-08-01 00:00:00
修订时间 :2008-09-05 16:51:41

[原文]Cross-Site Request Forgery (CSRF) vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user.

[CNNVD]TDiary 跨站点伪造请求攻击(CNNVD-200508-003)

        TDiary 2.1.1、2.0.1及早期版本中存在跨站点伪造请求(CSRF)漏洞。这使得远程攻击者可以作为另一用户执行操作,并且可以借助于由用户激活的URL在服务器上执行命令。

- CVSS (基础分值)

CVSS分值: 5.1 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(UNKNOWN)  XF  tdiary-xs-request-forgery(21735)
(UNKNOWN)  BID  14500

- 漏洞信息

TDiary 跨站点伪造请求攻击
中危 设计错误
2005-08-01 00:00:00 2006-10-31 00:00:00
        TDiary 2.1.1、2.0.1及早期版本中存在跨站点伪造请求(CSRF)漏洞。这使得远程攻击者可以作为另一用户执行操作,并且可以借助于由用户激活的URL在服务器上执行命令。

- 公告与补丁

        tDiary tDiary 2.0.1
        tDiary tdiary-full-2.0.2.tar.gz
        tDiary tDiary 2.1.1
        tDiary tdiary-full-2.1.2.tar.gz

- 漏洞信息 (F39999)

Debian Linux Security Advisory 808-1 (PacketStormID:F39999)
2005-09-13 00:00:00

Debian Security Advisory DSA 808-1 - The tdiary Development Team has discovered a Cross-Site Request Forgery (CSRF) vulnerability in tdiary, a new generation weblog that can be exploited by remote attackers to alter the users information.

Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 808-1                                        Martin Schulze
September 12th, 2005          
- --------------------------------------------------------------------------

Package        : tdiary
Vulnerability  : design error
Problem type   : remote
Debian-specific: no
CVE ID         : CAN-2005-2411

The tdiary Development Team has discovered a Cross-Site Request
Forgery (CSRF) vulnerability in tdiary, a new generation weblog that
can be exploited by remote attackers to alter the users information.

The old stable distribution (woody) does not contain tdiary packages.

For the stable distribution (sarge) this problem has been fixed in
version 2.0.1-1sarge1.

For the unstable distribution (sid) this problem has been fixed in
version 2.0.2-1.

We recommend that you upgrade your tdiary packages.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:
      Size/MD5 checksum:      698 725575945a14b3ff9ff776e4254b6e54
      Size/MD5 checksum:    24611 df8afbbc86e0f1a9f365a1b8271e7a12
      Size/MD5 checksum:  1840990 eaec0d3c00e1605d5cefad4119718183

  Architecture independent components:
      Size/MD5 checksum:   109264 b3de14edff72c292002d68b4f6c5234c
      Size/MD5 checksum:    27768 632e5ed6bb82fce0d1f787aea0b25cf4
      Size/MD5 checksum:   155066 6100fce2dbe0a8acc5a365766b2b8b84
      Size/MD5 checksum:  1506732 6a77d569ef301bc299ee4fe8e4f929f5
      Size/MD5 checksum:   171434 b31846dc0632acdb13787a5ec28e8bc5

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb stable/updates main
For dpkg-ftp: dists/stable/updates/main
Mailing list:
Package info: `apt-cache show <pkg>' and<pkg>

Version: GnuPG v1.4.1 (GNU/Linux)



- 漏洞信息

tDiary URL Activation CSRF
Remote / Network Access Input Manipulation
Loss of Integrity
Exploit Unknown

- 漏洞描述

tDiary contains a flaw that allows a Cross-Side Request Forgery (CSRF). This flaw exists because the application does not verify that requests to privileged URLs come from appropriate tDiary web pages. This could allow a user to create a malicious URL (within or outside the tDiary application) which if followed by an authenticated tDiary user, causes privileged actions to happen on behalf of the tDiary user or web server. This flaw can be used to delete tDiary entries, change tDiary configurations, and execute privileged commands on behalf of the web server.

- 时间线

2005-08-08 Unknow
Unknow Unknow

- 解决方案

Upgrade to stable release 2.0.2 or higher, or development release 2.1.2 or higher as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds or patches.

- 相关参考

- 漏洞作者

- 漏洞信息

TDiary Cross-Site Request Forgery Vulnerability
Design Error 14500
Yes No
2005-08-08 12:00:00 2009-07-12 04:06:00
Discovery is credited to Yutaka OIWA and Hiromitsu TAKAGI.

- 受影响的程序版本

tDiary tDiary 2.1.1
tDiary tDiary 2.0.1
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 amd64
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
tDiary tDiary 2.1.2
tDiary tDiary 2.0.2

- 不受影响的程序版本

tDiary tDiary 2.1.2
tDiary tDiary 2.0.2

- 漏洞讨论

tDiary is prone to a cross-site request forgery vulnerability. This issue may allow a remote attacker to delete data and configuration settings and potentially execute commands on an affected computer.

tDiary 2.0.1 and prior and tDiary 2.1.1 are affected by this issue.

- 漏洞利用

An exploit is not required.

- 解决方案

The vendor has released tDiary versions 2.0.2 and 2.1.2 to address this issue.

Debian Linux has released security advisory DSA 808-1 addressing this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

tDiary tDiary 2.0.1

tDiary tDiary 2.1.1

- 相关参考