Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <B3C4AA9A-71F8-4941-B132-1AC09BE202C7@joshuawise.com>
Date: Thu, 18 Jul 2013 00:14:47 -0700
From: Joshua Wise <joshua@...huawise.com>
To: oss-security@...ts.openwall.com
Cc: Joshua Wise <joshua@...huawise.com>,
 elly@...toquark.net,
 Evan Prodromou <evan@...n.com>
Subject: CVE-2013-4137: StatusNet v1.1.0: SQL injection

This is an advisory for StatusNet v1.0.0 through v1.1.0.

Multiple user-facing functions do not sanitize API input before interpolating it into database query strings.  This can result of exfiltration of database data, and depending on MySQL server (mis)configuration, can also result in file I/O to the database server disk.

StatusNet versions 1.1.1 and 1.0.2 have been released to correct these issues.  Patching to these versions as soon as possible is advised.  For more information, visit:
  http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x

Advisory title: Multiple SQL injection vulnerabilities
Product: StatusNet
Discovered by:
  Elly Fong-Jones
  Joshua Wise (NVIDIA Corporation)
Known vulnerable versions: 1.0.0 - 1.1.0
Tested: 1.1.0, 2013-07-16
Fixed in version: 1.1.1
Vulnerability type: CWE-89 (SQL Injection)
CVE IDs: CVE-2013-4137

My thanks to the Evan Prodromou for his help in quickly responding to these issues and releasing a new version.

joshua

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.