[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1012061711580.25660@faron.mitre.org>
Date: Mon, 6 Dec 2010 17:13:02 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: vanilla forums before 2.0.10, xss
On Mon, 6 Dec 2010, Josh Bressers wrote:
> Use CVE-2010-4264 for the XSS. The commit is here:
> https://github.com/vanillaforums/Garden/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece
>
> As for the "linkbait" issue, I have no clue. Nothing in git seems to
> point at that.
>
> Steve, does MITRE have a precedent for such a thing?
The vendor is calling it a "vulnerability" which is good enough to assign
a CVE to, as a different vuln type than XSS.
My guess is that it's open redirect, which is used to redirect users away
from the site towards spam or malware. Just a guess, though.
- Steve
>
> Thanks.
>
> --
> JB
>
>
> ----- "Hanno Böck" <hanno@...eck.de> wrote:
>
>> Hi,
>>
>> http://vanillaforums.org/discussion/13119/vanilla-2.0.10-released/p1
>>
>> Two sound like security:
>> #
>> # Added SafeStyles configuration to prevent XSS linkjacking
>> # Patched potential linkbait vulnerability in dispatcher
>>
>> (although I don't know what a linkbait vulnerability is, maybe someone
>> wants
>> to enlighten me)
>>
>> --
>> Hanno Böck Blog: http://www.hboeck.de/
>> GPG: 3DBD3B20 Jabber/Mail: hanno@...eck.de
>>
>> http://schokokeks.org - professional webhosting
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
