Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 10 Nov 2012 13:28:41 +0100
From: Ralf Schlatterbeck <rsc@...tux.com>
To: Jan Lieskovsky <jlieskov@...hat.com>
Cc: oss-security@...ts.openwall.com,
	"Steven M. Christey" <coley@...us.mitre.org>,
	Michel Alexandre Salim <michel+fdr@...vestre.me>,
	Richard Jones <richard@...hanicalcat.net>
Subject: Re: CVE Request -- roundup: Multiple XSS flaws plus other security
 related fixes corrected in upstream 1.4.20 version

On Sat, Nov 10, 2012 at 06:54:46AM -0500, Jan Lieskovsky wrote:
> [A] * issue2550729: Fix password history display for anydbm backend,
> thanks to Ralf Hemmecke for reporting. (Ralf)
> [3] http://issues.roundup-tracker.org/issue2550729
> 
> [D] * Fix wrong execute permissions on some files,
> thanks to Cheer Xiao for the patch. (Ralf)
> 
> Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues [A]
> and [D] would also have security implications / IOW if those would be
> security flaws too.  Ralf please clarify. Thank you, Jan.

[A] Doesn't have security implications if roundup is correnctly
configured. The bug would create a python backtrace. Unless the "debug"
option in section [web] is set (which is explicitly discouraged) this
will only display "an error has occurred" in the web-interface. Even if
someone sets the debug option in a production release only the hashed
password could be disclosed. Note that this bug only affects the anydbm
backend which should not be used for a production version either.

[D] No security implications: Fixed some permissions on files in
roundup/cgi and locale directories. These are not accessible via the
web-server. So this doesn't constitute a remote vulnerability. Local
users don't gain anything executing these files as no privilege
escalation is involved (they could copy the file which is readable
anyway and make their local copy executable).

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: office@...tux.com
osAlliance member                       email: rsc@...lliance.com

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.