oss-security - Re: CVE Request for cacti

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 21 May 2009 10:57:30 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: Henri Salo <henri@...v.fi>, coley@...us.mitre.org
Subject: Re: CVE Request for cacti

On Mon, 18 May 2009, Robert Buchholz wrote:

> Do you have any indication this is not covered by CVE-2008-0783?

CVE-2008-0783 as intended by MITRE is only about the specific vectors that
are listed there.  Henri's vector is "new."  I wasn't aware that Cacti
fixed other issues - if so, we should probably assign a new CVE for "all
the other XSS fixed in 0.8.7b" and mention Henri's vector as one of them.

- Steve

>
> Robert
>
> [1]
> http://www.cacti.net/downloads/patches/0.8.7a/multiple_vulnerabilities-0.8.7a.patch
> [2] http://lists.debian.org/debian-security-announce/2008/msg00144.html
>
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.