[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0909011413120.5392@faron.mitre.org>
Date: Tue, 1 Sep 2009 15:41:10 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com, oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- OCS Inventory NG
On Mon, 17 Aug 2009, Jan Lieskovsky wrote:
> a SQL injection by machine blacklisting was reported on 2009-08-11:
>
> http://seclists.org/fulldisclosure/2009/Aug/0143.html
> http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=147&cntnt01returnid=15
CVE-2009-3042 is assigned for this specific issue.
Note that CVE-2009-3040 was assigned for multiple older SQL injections
that affected 1.02.
- Steve
======================================================
Name: CVE-2009-3040
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3040
Reference: BUGTRAQ:20090530 OCS Inventory NG 1.02 - Multiple SQL Injections
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/503936/100/0/threaded
Reference: MISC:http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_sql_injection.shtml
Reference: CONFIRM:http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=140&cntnt01returnid=72
Multiple SQL injection vulnerabilities in Open Computer and Software
(OCS) Inventory NG 1.02 for Unix allow remote attackers to execute
arbitrary SQL commands via the (1) N, (2) DL, (3) O and (4) V
parameters to download.php and the (5) SYSTEMID parameter to
group_show.php.
======================================================
Name: CVE-2009-3042
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3042
Reference: BUGTRAQ:20090811 Sql injection in OCS Inventory NG Server 1.2.1
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/505675/100/0/threaded
Reference: FULLDISC:20090811 Sql injection in OCS Inventory NG Server 1.2.1
Reference: URL:http://seclists.org/fulldisclosure/2009/Aug/0143.html
Reference: MILW0RM:9416
Reference: URL:http://www.milw0rm.com/exploits/9416
Reference: CONFIRM:http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=147&cntnt01returnid=15
Reference: SECUNIA:35311
Reference: URL:http://secunia.com/advisories/35311
SQL injection vulnerability in machine.php in Open Computer and
Software (OCS) Inventory NG 1.02.1 allows remote attackers to execute
arbitrary SQL commands via the systemid parameter, a different vector
than CVE-2009-3040.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
