oss-security - Re: wordpress 2.6.1

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 20 Aug 2008 12:16:41 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: wordpress 2.6.1

On Tue, 19 Aug 2008, Hanno [utf-8] Böck wrote:

> Just had a look at the wp 2.6.1 changelog.
>
> Two security relevant bugs are listed as fixed.
>
> http://trac.wordpress.org/ticket/7359
> I'd consider this worth a CVE. It's good that this ssl stuff got some
> attention lately (I think this is a similar issue to the recently reported
> cookie / secureflag issues, as it can undermine the sniffing-safety of
> ssl-enabled pages).

It's hard to read into this one since I don't know what they mean by
"SSL-aware" here, or what apply_filters() is intended to do.

Use CVE-2008-3747, to be filled in later.

> http://trac.wordpress.org/ticket/6871
>
> AFAICS this enables one to hide malicious plugins but is no real vuln. Not
> sure if it deserves a CVE.

Presumably, only the admin would be able to install plugins.  So plugin
"hiding" isn't feasible.  The admin knows which plugins were installed,
unless there's some other exploit that installs the plugins, in which case
there's a different vuln.  So I don't think this deserves a CVE either.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.