[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5125C5EE.3050000@redhat.com>
Date: Wed, 20 Feb 2013 23:59:58 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Salvatore Bonaccorso <carnil@...ian.org>
Subject: Re: CVE request: zoneminder: local file inclusion
vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/19/2013 02:47 AM, Salvatore Bonaccorso wrote:
> Hi
>
> In zoneminder forum the following announce was done already in
> 2011:
>
> http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979
Stupid Q, is there like an official security page? POsting stuff to a
forum is not exactly the easiest place to find things, can they setup
like zoneminder.com/security/ and at least list all the security
issues and link to them there so people don't have to dig through the
forums?
I say this because this is the first cve request I've ever seen for
zoneminder since I started assigning, and indeed, since 2008, so I'm
guessing there's a few more missing ones......
If someone wants to big through the forums to find them and post them
here that would probably be helpful (seriously, wanna pad your resume
and get a reference from me? first person to make 100 good CVE
requests wins).
> where zoneminder is prone to a local file inclusion vulnerability.
> From upstream versions prior to 1.24.4 are affected and the issue
> was fixed in 1.24.4 and 1.25.0.
>
> SVN commits fixing this issue for the 1.24.x versions are r3483
> and r3488, and patches:
>
> http://www.zoneminder.com/downloads/lfi-patch.txt
> http://www.zoneminder.com/downloads/lfi-patch2.txt
>
> I haven't found a CVE assigned to this already. In case I did not
> miss something, could you allocate a CVE for this issue?
>
> Debian Bug: http://bugs.debian.org/700912
Please use CVE-2013-0332 for this issue.
> Regards, Salvatore
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRJcXuAAoJEBYNRVNeJnmTxIAP/RppcXyl48K0o/7PRBeLBc5J
ShUjF0h2tZc5RDNcjDDyeESkcHCeT9iI1IGdXe0xN4sLIGnUcwEV8TsRVHiwP0lw
FYr1hDKn/OII2bwokCcvg60HN4BOzU0ZGyL/EhBMlv+eU+HsGEtZeKUqaEWTr3FS
39zXzkfFHd0SRfqye1FSVA4magi7f4bY58gu74dhd/uchu7+Hf8+NEyRsN2Nw8aM
bSEENydNsVS4xuihsmsPr6FD+FGPSI8D+HXAHyzYkp+WS9sSx+Sv1nsDQ/T4N1Tn
DYB/U+3x8QO2naf43uKh9GEtseTWtZTfCMghm6Bjh2ocbNDKHvhzF5jGa7/I9Yie
KQGLzPxvJkN45qJ/b8Lse0jPe6aQjJfFifzYQG0tNxGFF97A9hMynTGyRIPW+nNA
Jxnc4fKwPvGbqGbixEpHAUsmnR6IBFWOBzBbv8sUgiwYAzAPzuj/+97LMjD5cchJ
a/Et6jrbn2c/4n6241YjKsOe/TY/sK/NT/HtnksqM5A0RaElnelEbkSPt/9jZi0+
ncqAJ0Ta8HbptZCcuuI/xSGIHiANucQQfIFJp+w9Gb8yXfNRIP7GOvlgvryf9ZFR
wJN/+KPklkEPO/Xdpsp6bnilVN8gVKfZnf5o6WucBQGXKsiKLpEjIdWjn//6wXrH
2b8Gicemt1WgV6/F0tKV
=axec
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
