[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <001c01cc853e$e3934d90$9b7a6fd5@ml>
Date: Sat, 8 Oct 2011 01:15:45 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <oss-security@...ts.openwall.com>,
<jlieskov@...hat.com>,
<coley@...us.mitre.org>
Subject: Re: CVE Request -- Multiple security issues in various versions of AWStats
Hi Jan!
You asked about 6 CVE for holes, but there are 7 holes (with two variations
for holes #2 and #3), which I disclosed (but it's possible to make one CVE
entry for #4 with two XSS holes). Here is few moments concerning your asking
about CVE.
1. The holes #1 and #2 was already disclosed earlier, as I stated in my
advisory. I just remind about them for fullness of my advisory and to show
differences between versions of AWStats (that protecting parameter key was
added in version 1.2) and that this parameter can be bypassed. As I show in
examples for holes #2, #3, #5 and #6.
2. As I stated in my advisory, as I tested, for hole #1 (XSS) was vulnerable
version 1.1 build 1.6, but was not vulnerable 1.1 build 1.5 (which shipped
with AWStats 6.0 - from this version I've started using AWStats in 2004).
3. There are CVE entries already for #2 (and should be for #1, but I don't
know about such CVE and I've not found it in CVE database).
Open redirect vulnerability
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-5020
But as I showed in my advisory in case of #2, this fix can be bypassed, so
there can be made update for this CVE entry or made new entry.
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
----- Original Message -----
From: "Jan Lieskovsky" <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: <oss-security@...ts.openwall.com>; "MustLive"
<mustlive@...security.com.ua>
Sent: Friday, October 07, 2011 11:17 AM
Subject: CVE Request -- Multiple security issues in various versions of
AWStats
> Hello Josh, Steve, vendors,
>
> these doesn't look like CVE ids have been already assigned for:
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=740926#c0
> [2] http://secunia.com/advisories/46160/
> [3] http://seclists.org/fulldisclosure/2011/Sep/234
> [4] http://websecurity.com.ua/5380/
>
> If I counted correctly, six CVE ids should be assigned for these
> (since different versions are listed as vulnerable):
>
> 1) XSS (WASC-08) (in versions <=1.1):
> http://site/awredir.pl?url=javascript:alert(document.cookie)
>
> 2) Redirector (URL Redirector Abuse in WASC 2.0) (WASC-38):
> http://site/awredir.pl?url=http://websecurity.com.ua
>
> 3) SQL Injection (WASC-19): (version 1.2)
> http://site/awredir.pl?url='%20and%20benchmark(10000,md5(now()))/*
>
> 4) XSS (WASC-08) (in version 1.2):
>
> http://site/awredir.pl?url=%3Cscript%3Ealert(document.cookie)%3C
> /script%3E
>
> http://site/awredir.pl?key=%3Cscript%3Ealert(document.cookie)%3C
> /script%3E
>
> 5) HTTP Response Splitting (WASC-25):
>
> http://site/awredir.pl?key=04ed5362e853c72ca275818a7c0c5857&
> url=%0AHeader:1
>
> 6) CRLF Injection (Improper Input Handling in WASC 2.0) (WASC-20):
>
> http://site/awredir.pl?key=4b9faa91e2529400c4f3c70833b4e4a5&
> url=%0AText
>
> Could you allocate CVE identifiers for these? (let me know
> if further description of each of the issues is necessary prior
> assignment).
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
