Date: Tue, 6 Jul 2010 04:49:41 -0500 (CDT) From: security curmudgeon <jericho@...rition.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: Apache Axis2 Session Fixation : there has recently been a Session Fixation vulnerability reported in Apache : Axis2, see: : : References: : https://issues.apache.org/jira/browse/AXIS2-4739 : http://www.securityfocus.com/archive/1/511955/30/30/threaded : : There is already CVE-2010-2103 assigned for the Cross-Site Scripting : mentioned in the advisory above. However, there does not seem to be a : CVE for the Session Fixation flaw, so could you possibly assign one for : it too? Can we also get a CVE assigned for the other 186 issues I found in issues.apache.org dating back to 2002-03-04? CVE covers 73 of the 259 issues, some much more serious than session fixation in Axis. On a more serious note, does it have to be posted to Bugtraq or F-D to get attention here? If you search osvdb.org by reference for "issues.apache.org", you will see a substantional amount of vulnerabilities that are higher risk (e.g., auth bypass, XSS, arbitrary file disclosure, cleartext password disclosure, etc). Consider there were almost two dozen more vulnerabilities that didn't get added to OSVDB because the bug reports were too vague, inconclusive and/or the Apache staff never responded in any fashion to clarify the severity or verify the report. If we had more time to actually dig into the report / code, they likely would have been added. I am not entirely sure why this one is important enough to warrant an individual request to CVE for assignment, when much more serious issues exist, some of which are still oustanding last I checked. If CVE does assign an entry to this, please assign one to OSVDB 58803 for an Apache Wicket Session Fixation issue too. Thanks! - security curmudgeon
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ