[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150212235040.0BF9172E00D@smtpvbsrv1.mitre.org>
Date: Thu, 12 Feb 2015 18:50:40 -0500 (EST)
From: cve-assign@...re.org
To: john@...nuts.net
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: MovableType before 5.2.12 - Movable Type
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> MoveableType 5.2.12 was released today to fix a flaw where Perl's
> Storable::thaw() was called on data sent by unauthenticated remote users
> in some interfaces.
>
> https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html
> We are releasing Movable Type 6.0.7 and 5.2.12 as mandatory security updates.
> In previous versions, including the Movable Type 6.0.6 and 5.2.11 are susceptible
Note that 5.2.11 is open source (from the
https://movabletype.org/downloads/archives/5.x/MTOS-5.2.11.zip
distribution) but we think that 6.0.6 is not open source.
> The payload example provided to SixApart was a local file inclusion
> attack, but unauthenticated arbitrary remote code execution should be
> straightforward
Use CVE-2015-1592.
There aren't separate CVE IDs for different impacts of the underlying
"called on data sent by unauthenticated remote users" issue.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU3TuVAAoJEKllVAevmvmsww4H/i+mhMmZ/wXa2QXyMDfu3Ojr
lgPuScQ7/DNIEeKhdhnbjtlF4wRsdsohOx7CyYlNt3QjTu6h8ngGH+JG8sQjtcaU
OnB091V+hOAXsetdr5bZFDr/+o7a6lz/GrhaURJJHgXXcJhbWvrfn/vEuadVQZtS
26raOvgRmomr6T0+kv+6SSMCy78N7eHJnUDWHUS/d+2a/G5Hpe1pYWpvF5hZLNYY
uH9D4C6gmLdD0HaujOy+2Pv8QnE2OMFoQ14yfcdc+N2JxSVKA0I/50lbB0axMXDf
zmR2I18Sx4ccBm97yX2qFs5uqNk6O4nZQ74mRp003ZvQXqwN3RnW4YbbxGAVmaI=
=4v/h
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
