[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <m2ubg1$6og$1@ger.gmane.org>
Date: Thu, 30 Oct 2014 22:44:32 +0100
From: Damien Regad <dregad@...tisbt.org>
To: oss-security@...ts.openwall.com
Subject: Re: SQL injection vulnerability in MantisBT SOAP API
On 30.10.2014 22:07, P Richards wrote:
> CVE-2014-8554 is already assigned to this issue...
Sorry for the confusion here - Paul and I were actually both working on
the same issue simultaneously and without knowing it, and we both came
up with a patch and a CVE request...
So please disregard my earlier request, and let's use CVE-2014-8554
moving forward.
That said, it would be useful indeed if someone could update
CVE-2014-8554 with the data below, as this will become the "official"
reference for the issue and the fix.
> -----Original Message-----
> From: dregad@...il.com [mailto:dregad@...il.com] On Behalf Of Damien Regad
> Sent: 30 October 2014 20:55
> To: oss-security@...ts.openwall.com
> Subject: [oss-security] SQL injection vulnerability in MantisBT SOAP API
>
> Description:
>
> Several SQL injection vulnerabilities were identified in CVE-2014-1609, and subsequently fixed in MantisBT release 1.2.16 [1].
>
> However, it was recently discovered that the patch did not fully address the original problem in the SOAP API. Research demonstrates that using a specially crafted 'project id' parameter when calling mc_project_get_attachments(), an attacker could still perform an SQL injection.
>
> Affected versions:
> MantisBT >= 1.1.0a4, <= 1.2.17
>
> Fixed in versions:
> 1.2.18 (not yet released)
>
> Credit:
> Issue was discovered by
> - Edwin Gozeling and Wim Visser from ITsec Security Services BV
> (http://www.itsec.nl)
> - Paul Richards (former MantisBT developer)
>
> References:
> - further details, including patch available in our issue tracker [2] (
>
> Please assign a CVE ID for this issue, which is a follow-up on
> CVE-2014-1609 (the released fix of which was incomplete).
>
> [1] http://www.mantisbt.org/bugs/view.php?id=16880
> [2] http://www.mantisbt.org/bugs/view.php?id=17812
>
>
---
This email is free from viruses and malware because avast! Antivirus protection is active.
http://www.avast.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
