[<prev] [next>] [day] [month] [year] [list]
Message-Id: <B3C4AA9A-71F8-4941-B132-1AC09BE202C7@joshuawise.com>
Date: Thu, 18 Jul 2013 00:14:47 -0700
From: Joshua Wise <joshua@...huawise.com>
To: oss-security@...ts.openwall.com
Cc: Joshua Wise <joshua@...huawise.com>,
elly@...toquark.net,
Evan Prodromou <evan@...n.com>
Subject: CVE-2013-4137: StatusNet v1.1.0: SQL injection
This is an advisory for StatusNet v1.0.0 through v1.1.0.
Multiple user-facing functions do not sanitize API input before interpolating it into database query strings. This can result of exfiltration of database data, and depending on MySQL server (mis)configuration, can also result in file I/O to the database server disk.
StatusNet versions 1.1.1 and 1.0.2 have been released to correct these issues. Patching to these versions as soon as possible is advised. For more information, visit:
http://status.net/2013/07/16/security-alert-sql-injection-attack-for-statusnet-1-0-x-and-1-1-x
Advisory title: Multiple SQL injection vulnerabilities
Product: StatusNet
Discovered by:
Elly Fong-Jones
Joshua Wise (NVIDIA Corporation)
Known vulnerable versions: 1.0.0 - 1.1.0
Tested: 1.1.0, 2013-07-16
Fixed in version: 1.1.1
Vulnerability type: CWE-89 (SQL Injection)
CVE IDs: CVE-2013-4137
My thanks to the Evan Prodromou for his help in quickly responding to these issues and releasing a new version.
joshua
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
