oss-security - Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1090383007.1201011277484327110.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Fri, 25 Jun 2010 12:45:27 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Florian Streibelt <gentoo@...treibelt.de>,
        Mads Martin Joergensen <mmj@....dk>,
        "Morten K. Poulsen" <morten@...elingp.dk>,
        "Steven M. Christey" <coley@...us.mitre.org>,
        Michael Fleming <mfleming+rpm@...tfleminggent.com>
Subject: Re: CVE Request -- mlmmj -- Directory traversal flaw
 by editing and saving list entries via php-admin web interface

----- "Jan Lieskovsky" <jlieskov@...hat.com> wrote:

> Hi Steve, vendors,
> 
>    Florian Streibelt (yet in 2009) reported:
>    [1] http://bugs.gentoo.org/show_bug.cgi?id=259968#c0
> 
>    a directory traversal flaw in the way mlmmj (Mailing List Managing
>    Made Joyful), mailing list manager, processed users requests to edit
>    and save list entries, originating from php-admin web interface. A
>    remote, authenticated attacker could use these flaws to alter
>    integrity of the system (write and / or delete arbitrary files) by
>    providing a specially-crafted list variable content to the edit or
>    save request.
> 
>    Florian, please correct me, if I mangled the attack scenario, and it's
>    slightly different.
> 
>    Martin, Morten, are these two issues known upstream yet? Is there a
>    patch for them already?
> 
>    Steve, could you please allocate two CVE-2009-XXXX CVE ids?  (One for
>    1, 'edit' case, second for 2, 'save' case.) [Searching "Master Copy of
>    CVE" for "mlmmj" keyword returned nothing for me.]
> 

This should only need one ID. The flaw is unchecked input. Steve, if I'
mistaken, just yell.

CVE-2009-4896

Thanks

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.