CVE-2014-2243: Race Condition
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
Other sources
The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:
(bug 61346) SECURITY: Make token comparison use constant time. It seems like our token comparison would be vulnerable to timing attacks. This will take constant time.
The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not tested EPEL 5.
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html https://bugzilla.wikimedia.org/showbug.cgi?id=61346 https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.21.6 - Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.19.12 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.21.6 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.19.12 - Upgrade
Upgrade
MediaWiki (User.php token validation)to a version that resolves this vulnerability.Patch bug 61346
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2243?
CVE-2014-2243 has been classified as a high-severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2014-2243?
To fix CVE-2014-2243, upgrade your MediaWiki installation to version 1.22.3 or later, or to 1.21.6 or later.
What versions are affected by CVE-2014-2243?
CVE-2014-2243 affects MediaWiki versions prior to 1.19.12, 1.20.x before 1.20.6, 1.21.x before 1.21.6, and 1.22.x before 1.22.3.
What type of vulnerability is CVE-2014-2243?
CVE-2014-2243 is a user token validation vulnerability that can be exploited via brute-force attacks.
Is there a workaround for CVE-2014-2243?
There are no known workarounds for CVE-2014-2243; updating to a patched version is the only solution.