[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50A3D438.20602@redhat.com>
Date: Wed, 14 Nov 2012 10:26:16 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Ralf Schlatterbeck <rsc@...tux.com>, Jan Lieskovsky <jlieskov@...hat.com>,
"Steven M. Christey" <coley@...us.mitre.org>,
Michel Alexandre Salim <michel+fdr@...vestre.me>,
Richard Jones <richard@...hanicalcat.net>
Subject: Re: Re: CVE Request -- roundup: Multiple XSS flaws
plus other security related fixes corrected in upstream 1.4.20 version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 11/10/2012 05:28 AM, Ralf Schlatterbeck wrote:
> On Sat, Nov 10, 2012 at 06:54:46AM -0500, Jan Lieskovsky wrote:
>> [A] * issue2550729: Fix password history display for anydbm
>> backend, thanks to Ralf Hemmecke for reporting. (Ralf) [3]
>> http://issues.roundup-tracker.org/issue2550729
>>
>> [D] * Fix wrong execute permissions on some files, thanks to
>> Cheer Xiao for the patch. (Ralf)
>>
>> Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues
>> [A] and [D] would also have security implications / IOW if those
>> would be security flaws too. Ralf please clarify. Thank you,
>> Jan.
>
> [A] Doesn't have security implications if roundup is correnctly
> configured. The bug would create a python backtrace. Unless the
> "debug" option in section [web] is set (which is explicitly
> discouraged) this will only display "an error has occurred" in the
> web-interface. Even if someone sets the debug option in a
> production release only the hashed password could be disclosed.
> Note that this bug only affects the anydbm backend which should not
> be used for a production version either.
How is the password hashed?
> [D] No security implications: Fixed some permissions on files in
> roundup/cgi and locale directories. These are not accessible via
> the web-server. So this doesn't constitute a remote vulnerability.
> Local users don't gain anything executing these files as no
> privilege escalation is involved (they could copy the file which is
> readable anyway and make their local copy executable).
>
> Ralf
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with undefined - http://www.enigmail.net/
iQIcBAEBAgAGBQJQo9Q4AAoJEBYNRVNeJnmTHoEP/j7npeWvm5yQjofgZhJeletQ
n5nbn3hOEcmVS0mgE3MJQP9kp8Aeq4hH3IfuGPVUs/ip37+hCJjbk2uh6cmM7/PV
8BUgPHeSnPjSzaWcyWsxtvfXI8joc1V5RQdCJb3Amei5YAqndrMFUs+7TjSFWWDI
Y0rMwPo0+gOYsc5CYFOyXPsWAttBmuJqWxBM8H9d2QKIn/9WJOB2aiREgXlyHDHC
huQOWXRioDl5JIY/n+CkMFBxvWVwIiRqvImnPYhvx1Iv53io7Wvk8C6SbEfEhUFZ
XZviLRg3vYmvaHdfc68DmzVAJNNbS/bfd513GCumiUXd5Lj/82uVXRzYfzoKESNK
MucHQy2wppo6RvP9MjTsqt3PPS41bvkBHUBPUBNfDbKHyJnOV/ZcIxZx2NfSMuwQ
ZadK/bhC9BfTggF/zWkenhCgIeNMD8POmZ3sJSZAxjt48CtlMn/YxmEzEVWlG/ut
tcsw843Vo3KvciLjb2lLAD8DSZwARsr7weuaeBc6ml0EDm04rWndm9DnxgLrckGt
vP3VC5g8fq/Idii6z+zwqfJZnsEZTSc0QYQHmtuLcC/zsDerl5hv9HJjlZWZPREg
nmr+Aec+yow/o1J4XOcXOiwUw889N1YMKIMZddaJFNNUZKaRSYo2eQVHT7XtST87
eVYKoyEBbgF0qLIa3+Km
=/mbR
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
