[Mediawiki-l] MediaWiki stable release 2003-11-17 (security update)

Mon Nov 17 05:44:34 UTC 2003

New release contains a number of bug fixes (see release notes) and an  
important security update (see below). All sites are strongly  
encouraged to upgrade, or use the workarounds described below.

Release notes:
http://sourceforge.net/project/shownotes.php?release_id=198060

Download:
http://prdownloads.sourceforge.net/wikipedia/mediawiki-20031117.tar.gz? 
download

Previous versions of MediaWiki contained a flaw that could be exploited  
in some configurations to execute arbitrary PHP code on the server if  
the *.php files are located in a web-accessible directory and are  
runnable through the PHP interpreter. This likely includes most  
installations.

If you can't upgrade immediately, you should be able to easily  
substantially reduce the risk by doing one or more of the following:

* Leave just LocalSettings.php and the *.phtml files exposed to the  
web, moving the other *.php files into a directory that's not exposed  
to the web; set $IP to point to this directory in LocalSettings.php.
-or-
* Remove the "$IP/" or "{$IP}/" from all include() and include_once()  
statements, keeping the *.php and *.phtml files in one place.

* Explicitly disallow access to all the *.php files in the web server.

* Configure the server to run only *.phtml files through PHP, and not  
*.php. (If you do this, be sure your database passwords are not exposed  
through LocalSettings.php!)

-- brion vibber (brion @ pobox.com)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.wikimedia.org/pipermail/mediawiki-l/attachments/20031116/23c6f190/attachment.pgp 