|
Message-ID: <20091216115308.3941163a@redhat.com> Date: Wed, 16 Dec 2009 11:53:08 +0100 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: Re: Some small KDE issues On Thu, 10 Dec 2009 22:54:57 -0600 Raphael Geissert <geissert@...ian.org> wrote: > > Our KDE maintainer alerted us to this: > > http://www.ocert.org/advisories/ocert-2009-015.html > > http://www.kde.org/info/security/advisory-20091027-1.txt > > According to 0910291553490.22070@....redhat.com, ids were already requested. > > Maybe somebody needs to be prodded? I'd rather say it needs someone to do the work and clearly state what should get a CVE and why. Advisory text does not really map well to the list of patches. One obvious candidate is "do not allow non-http and non-webdav urls in XMLHTTPRequests" fix, related to a not-so-ideal application of the same origin policy on local files. Ark and Kmail are examples where it can lead to issues, but it does not seem from the upstream advisory there is an intention to close what was described as the source of the problem in Portcullis advisories (e.g. not using khtml as a default previewer in ark, or at least not with enabled javascript sounds reasonable). As for the XMLHTTPRequest fix, it should be noted that the restriction does not seem to be what other browsers do. Mozilla only allows local files to access other local urls (with the subdir restriction in recent versions), even using XMLHTTPRequest, but allows no remote access. I've been told WebKit has a tunable for that and the same restriction should be the default in recent versions (confirmed in e.g. recent chromium). Not restricting remote access can still allow stealing data from sites behind the firewall kind of attacks. As for KIO slaves issues, Tim posted his list already. For CVE assignment, they should probably be grouped by the fix time, as not all of them seem to have been fixed at the same time / version. So taking this to an account, do you have a proposal for the list of issue that should get CVE? -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.