oss-security - Re: CVE request: mantisbt

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0810221254090.25959@faron.mitre.org>
Date: Wed, 22 Oct 2008 12:55:39 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: hoffie@...too.org, coley@...re.org
Subject: Re: CVE request: mantisbt < 1.1.4: RCE

Here are 3 CVE's.  The cookie logout issue was a bit of a tossup.

- Steve

======================================================
Name: CVE-2008-4687
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4687
Reference: MILW0RM:6768
Reference: URL:http://www.milw0rm.com/exploits/6768
Reference: MLIST:[oss-security] 20081019 CVE request: mantisbt < 1.1.4: RCE
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/19/1
Reference: CONFIRM:http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/utility_api.php?r1=5679&r2=5678&pathrev=5679
Reference: CONFIRM:http://www.mantisbt.org/bugs/changelog_page.php
Reference: CONFIRM:http://www.mantisbt.org/bugs/view.php?id=0009704
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=242722

manage_proj_page.php in Mantis before 1.1.4 allows remote
authenticated users to execute arbitrary code via a sort parameter
containing PHP sequences, which are processed by create_function
within the multi_sort function in core/utility_api.php.

======================================================
Name: CVE-2008-4688
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4688
Reference: MLIST:[oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/20/1
Reference: CONFIRM:http://mantisbt.svn.sourceforge.net/viewvc/mantisbt/branches/BRANCH_1_1_0/mantisbt/core/string_api.php?r1=5285&r2=5384&pathrev=5384
Reference: CONFIRM:http://www.mantisbt.org/bugs/changelog_page.php
Reference: CONFIRM:http://www.mantisbt.org/bugs/view.php?id=9321

core/string_api.php in Mantis before 1.1.3 does not check the
privileges of the viewer before composing a link with issue data in
the source anchor, which allows remote attackers to discover an
issue's title and status via a request with a modified issue number.

======================================================
Name: CVE-2008-4689
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4689
Reference: MLIST:[oss-security] 20081020 Re: CVE request: mantisbt < 1.1.4: RCE
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/20/1
Reference: CONFIRM:http://www.mantisbt.org/bugs/changelog_page.php
Reference: CONFIRM:http://www.mantisbt.org/bugs/file_download.php?file_id=1988&type=bug
Reference: CONFIRM:http://www.mantisbt.org/bugs/view.php?id=9664

Mantis before 1.1.3 does not unset the session cookie during logout,
which makes it easier for remote attackers to hijack sessions.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.