[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1208242222430.13749@faron.mitre.org>
Date: Fri, 24 Aug 2012 22:29:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Henri Salo <henri@...v.fi>, Moritz Muehlenhoff <jmm@...ian.org>
Subject: Re: CVE-request: Roundcube XSS issues
On Mon, 20 Aug 2012, Kurt Seifried wrote:
>> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket:
>> http://trac.roundcube.net/ticket/1488613 Upstream patch:
>>
>> [snip]
>>
>> Issue 2b: Self XSS in e-mail body (Signature). Ticket:
>> http://trac.roundcube.net/ticket/1488613 Upstream patch:
>[snip]
>
> Please use CVE-2012-3508 for these two issues (same version, same type
> of vuln so cve merge).
Further investigation into ticket 1488613 shows that the developer thinks
that issue 2b doesn't need a backport to 0.7. This would suggest a SPLIT
based on different affected versions.
Plus it's not immediately clear whether this "self XSS" is really an XSS
or not - if I can modify my own signature, then I already have the
"privileges" on my browser to run script. But, if this "self XSS" is
really just reflected XSS, then that's a security issue to worry about.
This requires expertise in the Roundcube codebase to answer for sure,
though.
So, we should probably SPLIT this CVE.
CVE-2012-3508 - Issue 2a - Stored XSS in e-mail body
(new) CVE-2012-4668 - Issue 2b - Self XSS in e-mail body (Signature)
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
