[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 24 Mar 2009 20:19:48 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - openfire
Notice the open redirect issue (CVE-2008-6511), which doesn't appear to
have a vendor acknowledgement.
- Steve
======================================================
Name: CVE-2008-6508
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6508
Reference: BUGTRAQ:20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/498162/100/0/threaded
Reference: MILW0RM:7075
Reference: URL:http://www.milw0rm.com/exploits/7075
Reference: MISC:http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Reference: MISC:http://www.andreas-kurtz.de/archives/63
Reference: CONFIRM:http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html
Reference: CONFIRM:http://www.igniterealtime.org/issues/browse/JM-1489
Reference: BID:32189
Reference: URL:http://www.securityfocus.com/bid/32189
Reference: OSVDB:49663
Reference: URL:http://osvdb.org/49663
Reference: VUPEN:ADV-2008-3061
Reference: URL:http://www.vupen.com/english/advisories/2008/3061
Reference: XF:openfire-authcheckfilter-security-bypass(46488)
Reference: URL:http://xforce.iss.net/xforce/xfdb/46488
Directory traversal vulnerability in the AuthCheck filter in the Admin
Console in Openfire 3.6.0a and earlier allows remote attackers to
bypass authentication and access the admin interface via a .. (dot
dot) in a URI that matches the Exclude-Strings list, as demonstrated
by a /setup/setup-/.. sequence in a URI.
======================================================
Name: CVE-2008-6509
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6509
Reference: BUGTRAQ:20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/498162/100/0/threaded
Reference: MILW0RM:7075
Reference: URL:http://www.milw0rm.com/exploits/7075
Reference: MISC:http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Reference: MISC:http://www.andreas-kurtz.de/archives/63
Reference: CONFIRM:http://www.igniterealtime.org/issues/browse/JM-1488
Reference: BID:32189
Reference: URL:http://www.securityfocus.com/bid/32189
Reference: OSVDB:51912
Reference: URL:http://osvdb.org/51912
Reference: VUPEN:ADV-2008-3061
Reference: URL:http://www.vupen.com/english/advisories/2008/3061
Reference: XF:openfire-siparklogsummary-sql-injection(46487)
Reference: URL:http://xforce.iss.net/xforce/xfdb/46487
SQL injection vulnerability in CallLogDAO in SIP Plugin in Openfire
3.6.0a and earlier allows remote attackers to execute arbitrary SQL
commands via the type parameter to sipark-log-summary.jsp.
======================================================
Name: CVE-2008-6511
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6511
Reference: BUGTRAQ:20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/498162/100/0/threaded
Reference: MILW0RM:7075
Reference: URL:http://www.milw0rm.com/exploits/7075
Reference: MISC:http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and
earlier allows remote attackers to redirect users to arbitrary web
sites and conduct phishing attacks via the url parameter.
======================================================
Name: CVE-2008-6511
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-6511
Reference: BUGTRAQ:20081108 [AK-ADV2008-001] Openfire Jabber-Server: Multiple Vulnerabilities (Authentication Bypass, SQL injection, ...)
Reference: URL:http://www.securityfocus.com/archive/1/archive/1/498162/100/0/threaded
Reference: MILW0RM:7075
Reference: URL:http://www.milw0rm.com/exploits/7075
Reference: MISC:http://www.andreas-kurtz.de/advisories/AKADV2008-001-v1.0.txt
Open redirect vulnerability in login.jsp in Openfire 3.6.0a and
earlier allows remote attackers to redirect users to arbitrary web
sites and conduct phishing attacks via the url parameter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
