[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110627145835.GA14674@foo.fgeek.fi>
Date: Mon, 27 Jun 2011 17:58:35 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: incidents@...rt.org, lists@...g.net, bressers@...hat.com
Subject: Re: CVE request: Joomla unspecified information
disclosure vulnerability
On Mon, Jun 27, 2011 at 03:53:27PM +0800, YGN Ethical Hacker Group wrote:
> Path Disclosure should better be regarded as more closely related to
> server-side issue.
> It may be too redundant or unnecessary to create one path disclosure
> issue per CVE.
>
> Another Path Disclosure issue in Joomla! 1.6.1
>
> http://bl0g.yehg.net/2011/04/joomla-161-and-lower-information.html
>
>
> Almost all php CMS applications have this issue going on where some
> of them are listed at:
>
> http://code.google.com/p/inspathx/source/browse/#svn%2Ftrunk%2Fpaths_vuln
I think this deserves own CVE-identifier as Joomla did announce security vulnerability. As far as I know the vulnerability was described as "Information Disclosure" not patch disclosure. Path disclosures should be fixed from software also, but usually it is a problem in web-server configuration. Do you have more information about issue CVE-2011-2488? Still no reply from Joomla security team regarding issue CVE-2011-2488. I asked more details nearly a week ago.
Btw. I would use domain example.org in advisories if I were you. You might not always want to keep that attacker.in domain.
Best regards,
Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
