[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 12 Sep 2012 13:49:46 -0400
From: Andrew Nacin <nacin@...dpress.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, Hanno Boeck <hanno@...eck.de>,
security@...dpress.org
Subject: Re: CVEs for wordpress 3.4.2 release
On Wed, Sep 12, 2012 at 1:04 PM, Kurt Seifried <kseifried@...hat.com> wrote:
> On 09/12/2012 04:38 AM, Hanno Boeck wrote:
> > I can't find CVEs assigend for the issues fixed in wordpress
> > 3.4.2.
> >
> > http://wordpress.org/news/2012/09/wordpress-3-4-2/
> >
> >
> > Sadly, the information is quite limited: "Version 3.4.2 also fixes
> > a few security issues and contains some security hardening. The
> > vulnerabilities included potential privilege escalation and a bug
> > that affects multisite installs with untrusted users. These issues
> > were discovered and fixed by the WordPress security team."
> >
> > I suggest assigning two: 1. potential privilege escalation 2.
> > problem with untrusted users on multisite installations unless
> > someone has more information.
>
> Can security@...dpress.org provide clarification on this please?
The second one there is CVE-2012-3383. 3.4.1 remained affected; fixed in
3.4.2.
We are more specific on our version pages. From
http://codex.wordpress.org/Version_3.4.2:
* Fix unfiltered HTML capabilities in multisite (this is CVE-2012-3383)
* Fix possible privilege escalation in the Atom Publishing Protocol
endpoint
* Allow operations on network plugins only through the network admin
Details for the other two:
* AtomPub allowed contributors to publish posts, which is normally reserved
for users of an author role or higher. This should be considered low risk,
low
impact. An additional mitigating factor is that AtomPub is off by default
and
rarely enabled. (In WordPress 3.5, AtomPub will no longer be a part of
core.)
* For multisite, plugins that must be activated network-wide could be
activated by a non-network administrator. This is only if they were already
installed by a network administrator, but left inactive. This could also
only
occur if the network administrator allowed individual site administrators to
manage plugins -- by default, this is not the case, and it is rare. Again,
not
particularly high risk or impact.
Regards,
Andrew Nacin
Lead Developer
WordPress
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
