oss-security - Re: [OSVDB Mods] [New Vulnerability] File Disclosure in SimpleMachines Forum <= 2.0.3 (CVE-2013-0192) (fwd)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1301301335340.22747@forced.attrition.org>
Date: Wed, 30 Jan 2013 13:36:30 -0600 (CST)
From: Brian Martin <brian@...nsecurityfoundation.org>
To: oss-security@...ts.openwall.com
Subject: Re: [OSVDB Mods] [New Vulnerability] File Disclosure in SimpleMachines
 Forum <= 2.0.3 (CVE-2013-0192) (fwd)

FYI:

Kurt has indicated that the 2009 disclosure affects 1.x, and the new 
affects 2.x, so they warrant separate CVEs. This is the official request 
for it.

Brian
OSF / OSVDB.org

---------- Forwarded message ----------
From: Brian Martin <brian@...nsecurityfoundation.org>
To: Carlos Alberto Lopez Perez <clopez@...lia.com>
Cc: OSVDB Mods <moderators@...db.org>, Kurt Seifried <kseifried@...hat.com>
Date: Wed, 30 Jan 2013 13:27:35 -0600 (CST)
Subject: Re: [OSVDB Mods] [New Vulnerability] File Disclosure in SimpleMachines
     Forum <= 2.0.3 (CVE-2013-0192)

On Wed, 30 Jan 2013, Carlos Alberto Lopez Perez wrote:

: There is a file disclosure vulnerability in SMF (Simple Machines Forum)
: affecting versions <= 2.0.3 [1]
:
: The vulnerability has been assigned CVE-2013-0192 [2] and requires a
: valid admin backend login to be exploited, therefore has a low security
: impact score.
:
: On some configurations a SMF deployment is shared by several "co-admins"
: that are not trusted beyond the SMF deployment. This vulnerability
: allows them to read arbitrary files on the filesystem and therefore gain
: new privileges by reading the settings.php with the database passwords.

Thanks for the information Carlos.

Kurt; This was originally disclosed in 2009 (see OSVDB 86444 [1]) and
re-discovered in January 13. If you concur, do you want to see about
issuing a 2009 CVE? One was never issued for the original disclosure.

Brian
OSF / OSVDB.org

[1] http://osvdb.org/86444

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.