[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.LNX.2.00.1007060436540.10953@forced.attrition.org>
Date: Tue, 6 Jul 2010 04:49:41 -0500 (CDT)
From: security curmudgeon <jericho@...rition.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Apache Axis2 Session Fixation
: there has recently been a Session Fixation vulnerability reported in Apache
: Axis2, see:
:
: References:
: https://issues.apache.org/jira/browse/AXIS2-4739
: http://www.securityfocus.com/archive/1/511955/30/30/threaded
:
: There is already CVE-2010-2103 assigned for the Cross-Site Scripting
: mentioned in the advisory above. However, there does not seem to be a
: CVE for the Session Fixation flaw, so could you possibly assign one for
: it too?
Can we also get a CVE assigned for the other 186 issues I found in
issues.apache.org dating back to 2002-03-04? CVE covers 73 of the 259
issues, some much more serious than session fixation in Axis.
On a more serious note, does it have to be posted to Bugtraq or F-D to get
attention here? If you search osvdb.org by reference for
"issues.apache.org", you will see a substantional amount of
vulnerabilities that are higher risk (e.g., auth bypass, XSS, arbitrary
file disclosure, cleartext password disclosure, etc). Consider there were
almost two dozen more vulnerabilities that didn't get added to OSVDB
because the bug reports were too vague, inconclusive and/or the Apache
staff never responded in any fashion to clarify the severity or verify the
report. If we had more time to actually dig into the report / code, they
likely would have been added.
I am not entirely sure why this one is important enough to warrant an
individual request to CVE for assignment, when much more serious issues
exist, some of which are still oustanding last I checked.
If CVE does assign an entry to this, please assign one to OSVDB 58803 for
an Apache Wicket Session Fixation issue too. Thanks!
- security curmudgeon
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
