oss-security - Re: Re: CVE

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.64.1209051820410.14248@faron.mitre.org>
Date: Wed, 5 Sep 2012 18:25:09 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
cc: Lukas Reschke <lukas@...tuscode.ch>
Subject: Re: Re: CVE - ownCloud

On Sat, 1 Sep 2012, Kurt Seifried wrote:

> - -------------
> Version 4.0.6 Aug 1th 2012
>
> Security: Check for Admin user in
> appconfig.php (CSRF)
> Registered user could change app configs without admin rights.
> https://github.com/owncloud/core/commit/9605e1926c6081e88326bf78a02c1d1b83126c4f
> Security: Several CSRF security fixes
> The admin settings and the bookmark app wasn't checking the CSRF token.
> https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f
> and
> https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745
>
> CVS merged into a single CVE
>
> Please use CVE-2012-4393 for these issues.

Our interpretation is that this line item is not CSRF:

   "Registered user could change app configs without admin rights"

It's a permissions/authorization problem.  It's made WORSE by CSRF, but 
even without CSRF, a registered user could do something they shouldn't.

So, we assigned CVE-2012-4752 for "Registered user could change app 
configs without admin rights"

> Version 4.0.5 July 20th
> Reflected XSS (XSS)
> The filelist wasn't sanitzing HTML values in image files.
> https://github.com/owncloud/core/commit/d203fa2c50f4b2791e68e2b8ab9a0f8b94f9c9f8
>
> Please use CVE-2012-4394 for this issue.

The 4.0.5 changelog at http://owncloud.org/changelog/ also says "Several 
CSRF security fixes"

So, we assigned CVE-2012-4753 for the CSRF fixed by 4.0.5.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.