[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <508386BA.80901@redhat.com>
Date: Sat, 20 Oct 2012 23:23:06 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: nicolas.alvarez@...il.com
Subject: Re: CVE Request: viewvc 1.1.5 lib/viewvc.py XSS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/20/2012 11:19 PM, Kurt Seifried wrote:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691062
>
> From: Nicolás Alvarez <nicolas.alvarez@...il.com> To: Debian Bug
> Tracking System <submit@...s.debian.org> Subject: viewvc: XSS bug
> in diff view Date: Sat, 20 Oct 2012 17:54:18 -0300 [Message part 1
> (text/plain, inline)] Package: viewvc Version: 1.1.5-1.3 Severity:
> important Tags: security
>
> There is an XSS bug in the diff view, exploitable by people with
> commit access to the repository. The "function name" lines returned
> by diff (in the diff lines starting with @@) are not HTML-escaped.
>
> Here's an example. Add this file to a SVN repository:
>
> blah x <script>alert("XSS!");</script> one context two context
> three context trigger
>
> Commit it. Next, change the line labeled 'trigger', and commit
> again. The diff produced by the second commit is:
>
> @@ -3,4 +3,4 @@ x <script>alert("XSS!");</script> one context two
> context three context -trigger +trigger X
>
> When telling ViewVC to show the diff of that file for the last
> commit, it doesn't HTML-escape the <script>, so it gets executed.
>
> I'm attaching a patch that should fix this bug.
>
> I don't have a CVE number. I haven't reported this upstream. I
> quickly glanced at the upstream bug list and dev list archives and
> it didn't seem to be already reported, but I didn't search
> carefully.
I checked CVE (nothing for this) and the ChangeLogs/etc. This is
indeed a new issue. Please use CVE-2012-4533 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iQIcBAEBAgAGBQJQg4a6AAoJEBYNRVNeJnmTOm0P/3ZtfO5AjJ2XTpOHK6lya/fn
23n/TZsInUHFL9jyKgeXEnRMrYEda5BYwoA1Ypd/umfVjUgM9N+yRo1ye9DADGxw
+6pSFKDLo9MDHpSx0TjRerdFnxbnnf64dX1sPktXZxkJBVKmV5wlQghjNq3G4DdS
ebhRYeIvhwkzCe4sy7zaOJt2/+GIi+GMeVejSwyqdaiOmfMCeGcZDbAhSbSVl8/q
niCWcClOMcQsxJdEJtQZJzUHZaDpbuM6ETJsvmnL76+c0lcrnJZerxIC/Udpp6Ha
okNZRwRM5Cjhza5MI6rtaO9+gKi9/F3WiU0Cgg2vf3tq3pScnm+fyZvY4HaBFB2V
gVvomJLi8IN6rwZjpgPPt4rJObV4xYScdL7KqHrU2iEWmHvEeToOOoRWUtvPspiG
ZdBehTy1K/ZF1w9cusU9oC1FK9xtHBNY5eyvN5mwyxKeDAe2jcwEYZHUBtuev/Hw
REFTKCBrHek1sDiNfD/NF4AEN2QYiJRC+MgwWI5k/O8SHNF4JH+gBw05b7LJjU0X
prj/owExb431fd3dOlqSKnx1EtVTUnDA4Z/H6hnYMvDVviRSsodkOimg2w36OVLZ
//ook5dNxCb7kKJp2+crWLS+I8exzBDwkNtSC1xCJ1XtJTtng+J4EGiO0SodSV18
eDwMJt8qjchOJElv1y4j
=AINE
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
