Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Sep 2012 13:49:46 -0400
From: Andrew Nacin <nacin@...dpress.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, Hanno Boeck <hanno@...eck.de>, 
	security@...dpress.org
Subject: Re: CVEs for wordpress 3.4.2 release

On Wed, Sep 12, 2012 at 1:04 PM, Kurt Seifried <kseifried@...hat.com> wrote:

> On 09/12/2012 04:38 AM, Hanno Boeck wrote:
> > I can't find CVEs assigend for the issues fixed in wordpress
> > 3.4.2.
> >
> > http://wordpress.org/news/2012/09/wordpress-3-4-2/
> >
> >
> > Sadly, the information is quite limited: "Version 3.4.2 also fixes
> > a few security issues and contains some security hardening. The
> > vulnerabilities included potential privilege escalation and a bug
> > that affects multisite installs with untrusted users. These issues
> > were discovered and fixed by the WordPress security team."
> >
> > I suggest assigning two: 1. potential privilege escalation 2.
> > problem with untrusted users on multisite installations unless
> > someone has more information.
>
> Can security@...dpress.org provide clarification on this please?


The second one there is CVE-2012-3383. 3.4.1 remained affected; fixed in
3.4.2.

We are more specific on our version pages. From
http://codex.wordpress.org/Version_3.4.2:

 * Fix unfiltered HTML capabilities in multisite (this is CVE-2012-3383)
 * Fix possible privilege escalation in the Atom Publishing Protocol
endpoint
 * Allow operations on network plugins only through the network admin

Details for the other two:

 * AtomPub allowed contributors to publish posts, which is normally reserved
for users of an author role or higher. This should be considered low risk,
low
impact. An additional mitigating factor is that AtomPub is off by default
and
rarely enabled. (In WordPress 3.5, AtomPub will no longer be a part of
core.)

 * For multisite, plugins that must be activated network-wide could be
activated by a non-network administrator. This is only if they were already
installed by a network administrator, but left inactive. This could also
only
occur if the network administrator allowed individual site administrators to
manage plugins -- by default, this is not the case, and it is rare. Again,
not
particularly high risk or impact.

Regards,

Andrew Nacin
Lead Developer
WordPress

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ