[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120809150044.GQ1965@sentinelchicken.org>
Date: Thu, 9 Aug 2012 08:00:44 -0700
From: Tim <tim-security@...tinelchicken.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, Heather Leson <HLeson@...ahidi.com>
Subject: Re: CVE request for Ushahidi
Hi Kurt,
Do we have CVEs for these yet? Not sure if I missed the reply.
Thanks,
tim
On Thu, Aug 02, 2012 at 04:50:17PM +1200, Robbie Mackay wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi Kurt,
> I've added info on which researcher discovered the vulnerability in
> each commit. Anything other info needed?
>
> Thanks,
> Robbie Mackay
> Software Developer, External Projects, Ushahidi Inc
>
> * Multiple SQL injections (Reported by Timothy D. Morgan, Kees Cook,
> postmodern )
> https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1 (identified by
> Ushahidi dev team)
> https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919 (postmodern)
> https://github.com/ushahidi/Ushahidi_Web/commit/4764792 (identified by
> Ushahidi dev team)
> https://github.com/ushahidi/Ushahidi_Web/commit/d954093 (identified by
> Ushahidi dev team)
> https://github.com/ushahidi/Ushahidi_Web/commit/3301e48 (Kees Cook)
> https://github.com/ushahidi/Ushahidi_Web/commit/68d9916 (postmodern)
> https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66 (postmodern)
> https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c (postmodern)
> https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0 (Timothy D.
> Morgan)
>
> * Missing authentication on comments, reports, email API calls
> (Reported by Kees Cook, Dennison Williams)
> https://github.com/ushahidi/Ushahidi_Web/commit/4c24325 (Dennison
> Williams)
> https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad (Kees Cook)
> https://github.com/ushahidi/Ushahidi_Web/commit/13ca6f4 (Kees Cook)
>
> * User details exposed in comments API (Discovered by internal dev team)
> https://github.com/ushahidi/Ushahidi_Web/commit/529f353
>
> * Admin user hijacking through the installer (Reported by Wil Clouser)
> https://github.com/ushahidi/Ushahidi_Web/commit/7892559
> https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03
>
> * Stored XSS on member profile pages (Reported by Amy K. Farrell)
> https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f
>
>
> On 1/08/12 6:07 AM, Kurt Seifried wrote:
> > On 07/30/2012 06:22 PM, Robbie MacKay wrote:
> >> The Ushahidi team have been notified of the following security
> >> vulnerabilities thanks to volunteers from OWASP Portland. These
> >> will be fixed in the upcoming 2.5 release. Could you please
> >> allocate CVEs for the following issues?
> >
> >> * Multiple SQL injections (Reported by Timothy D. Morgan, Kees
> >> Cook, postmodern )
> >> https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
> >> https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919
> >> https://github.com/ushahidi/Ushahidi_Web/commit/4764792
> >> https://github.com/ushahidi/Ushahidi_Web/commit/d954093
> >> https://github.com/ushahidi/Ushahidi_Web/commit/3301e48
> >> https://github.com/ushahidi/Ushahidi_Web/commit/68d9916
> >> https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66
> >> https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c
> >> https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0
> >
> >> * Missing authentication on comments, reports, email API calls
> >> (Reported by Kees Cook, Dennison Williams)
> >> https://github.com/ushahidi/Ushahidi_Web/commit/4c24325
> >> https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad
> >
> >> * User details exposed in comments API (Discovered by internal
> >> dev team)
> >> https://github.com/ushahidi/Ushahidi_Web/commit/529f353
> >
> >> * Admin user hijacking through the installer (Reported by Wil
> >> Clouser) https://github.com/ushahidi/Ushahidi_Web/commit/7892559
> >> https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03
> >
> >> * Stored XSS on member profile pages (Reported by Amy K. Farrell)
> >> https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f
> >
> >> Thanks in advance,
> >
> >> Robbie Mackay
> >
> > You'll need to list which commits were found by which security
> > reporter (e.g. which ones are Reported by Timothy D. Morgan, Kees
> > Cook, postmodern). Thanks.
> >
> >
> >> Software Developer, External Projects Ushahidi Inc e:
> >> robbie@...ahidi.com skype: robbie.mackay
> >
> >
> >
> >
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJQGgcJAAoJEKnxsxigzOTXl7oH/1u8LLLxzy7SAKNxmVLPTwCK
> TKA8dal726TeIqyforOdXFABKkie+PjdeIBQM9FBHhgnAAQNhNa+K/DR9xg59JTd
> BjpAO/J4yyteyJdxh8+Xi31xbsWUyPdHDa79nLQ0PsetmXRd8EJ4xaL/EWK5N6hL
> OGnrQqujy4jTpwulf43D+gO7Rd6iZS4i+ghCUPpQ5IUeSvIMW5dYFrhgOLKjT5b/
> okfdxBASbTZhc7nNZc0giQ4rGUrdcSOxQF7O0A2w2zELV/hBTRBN8mtBuY7DSgVO
> bLUjsHjKcFCbK90VoKdjxhTW7+KtLTUtdhanN4QzM7uRAqa8V1DTaBssn3Nu2YU=
> =tBbs
> -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
