oss-security - Re: CVE request: multiple issues in ViewVC

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 12 Mar 2008 12:14:46 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: multiple issues in ViewVC

On Wed, 12 Mar 2008, Pierre-Yves Rofes wrote:

>  multiple security issues were fixed in the latest ViewVC release,
> apparently no CVE ids were assigned yet. Could we get some?
>
> Secunia advisory: http://secunia.com/advisories/29176/
> Gentoo Bug: https://bugs.gentoo.org/show_bug.cgi?id=212288

This was one of those complex issues where, if you looked at the original
changelog, you couldn't tell how many CVEs to assign.  Thus the delay,
though the bug report definitely helps.

CVEs will be filled in later today.

CVE-2008-1290 - list CVS or SVN commits on "all-forbidden"
files

CVE-2008-1291 - directly access hidden CVSROOT folders

CVE-2008-1292 - expose restricted content via the revision
view, the log history, or the diff view

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.