Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 11 Jul 2014 10:19:00 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: mmcallis@...hat.com, vkaigoro@...hat.com, cve-assign@...re.org
Subject: Re: Re: CVE request: XSS in PNP4Nagios

Hi,

On Fri, Jul 11, 2014 at 03:11:22AM -0400, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> > Jun 04, 2014 This issue was detected by Peter Osterberg
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php
> > https://github.com/lingej/pnp4nagios/commit/f846a6c9d007ca2bee05359af747619151195fc9
> > http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9
> 
> > - <p><?php echo $message ?></p>
> > + <p><?php echo html::specialchars($message) ?></p>
> 
> Use CVE-2014-4907.
> 
> 
> 
> > Jun 13, 2014  pnp/views/kohana_error_page: plug another XSS hole
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php
> > https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014
> 
> > Jun 13, 2014  Plug potential XSS hole in views/template.php
> > https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/template.php
> > https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bb
> 
> Use CVE-2014-4908 for both e4a19768a5c5e5b1276caf3dd5bb721a540ec014
> and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb. These are both
> 
>   <meta http-equiv="refresh" content="[INSERT_NUMBER_HERE]; url=<?php echo $_SERVER['REQUEST_URI'] ?>">
> 
> issues. We realize that it is possible that
> e4a19768a5c5e5b1276caf3dd5bb721a540ec014 was reported by an external
> researcher, and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb was
> discovered internally by the vendor, but there is apparently no
> available information confirming that.

I noticed that on Red Hat's Bugzilla these two are aliased to
CVE-2014-4740. Should thus CVE-2014-4740 be rejected, or is
CVE-204-4740 used for something different?

 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4740 i.e.
 https://bugzilla.redhat.com/show_bug.cgi?id=1115983 .

Regards,
Salvatore

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ