oss-security - Re: Re: CVE request: XSS in PNP4Nagios

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140711081900.GA29513@lorien.valinor.li>
Date: Fri, 11 Jul 2014 10:19:00 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: mmcallis@...hat.com, vkaigoro@...hat.com, cve-assign@...re.org
Subject: Re: Re: CVE request: XSS in PNP4Nagios

Hi,

On Fri, Jul 11, 2014 at 03:11:22AM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> > Jun 04, 2014 This issue was detected by Peter Osterberg
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php
> > https://github.com/lingej/pnp4nagios/commit/f846a6c9d007ca2bee05359af747619151195fc9
> > http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9
> 
> > - <p><?php echo $message ?></p>
> > + <p><?php echo html::specialchars($message) ?></p>
> 
> Use CVE-2014-4907.
> 
> 
> 
> > Jun 13, 2014  pnp/views/kohana_error_page: plug another XSS hole
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php
> > https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014
> 
> > Jun 13, 2014  Plug potential XSS hole in views/template.php
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/template.php
> > https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb
> 
> Use CVE-2014-4908 for both e4a19768a5c5e5b1276caf3dd5bb721a540ec014
> and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb. These are both
> 
>   <meta http-equiv="refresh" content="[INSERT_NUMBER_HERE]; url=<?php echo $_SERVER['REQUEST_URI'] ?>">
> 
> issues. We realize that it is possible that
> e4a19768a5c5e5b1276caf3dd5bb721a540ec014 was reported by an external
> researcher, and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb was
> discovered internally by the vendor, but there is apparently no
> available information confirming that.

I noticed that on Red Hat's Bugzilla these two are aliased to
CVE-2014-4740. Should thus CVE-2014-4740 be rejected, or is
CVE-204-4740 used for something different?

 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4740 i.e.
 https://bugzilla.redhat.com/show_bug.cgi?id=1115983 .

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.