Date: Sat, 16 Aug 2014 03:43:18 -0400 (EDT) From: cve-assign@...re.org To: forest.monsen@...il.com, nacin@...dpress.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request for Drupal core, and contributed modules -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > SA-CORE-2014-004 - Drupal core - Denial of service > https://www.drupal.org/SA-CORE-2014-004 [ as mentioned in the http://openwall.com/lists/oss-security/2014/08/07/3 post, "It was fixed by Michael Adams and Andrew Nacin of the WordPress security team and David Rothstein of the Drupal security team ... the code was the same and our patches differed only in coding standards" ] > http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 > https://core.trac.wordpress.org/changeset/29405/branches/3.9 Use CVE-2014-5265 for the code changes in xmlrpc.inc (Drupal) and class-IXR.php (WordPress) to prevent entity declarations and therefore address the "vulnerable to an XML entity expansion attack ... can cause CPU and memory exhaustion" concern. > http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 > http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 > https://core.trac.wordpress.org/changeset/29405/branches/3.9 Use CVE-2014-5266 for the "Skip parsing if there is an unreasonably large number of tags" in both xmlrpc.inc and xrds.inc (Drupal) and the "Bail if there are too many elements to parse" in class-IXR.php (WordPress). > http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 Use CVE-2014-5267 for the code change to reject any XRDS document with a /<!DOCTYPE/i match. (This is not really identical to CVE-2014-5265, although part of the goal is the same.) > And the appropriate number for the following Drupal contributed modules: > SA-CONTRIB-2014-075 - Biblio Autocomplete - SQL Injection and Access Bypass > https://www.drupal.org/node/2316717 > SQL Injection Use CVE-2014-5249. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5249 > Additionally, the AJAX autocompletion callback itself was not properly > secured, thus potentially allowing any visitor access to the data, > including the anonymous user. Use CVE-2014-5250. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-5250 > SA-CONTRIB-2014-076 - Fasttoggle - Access bypass > https://www.drupal.org/node/2316747 Use CVE-2014-5268. We think this means that, in the vulnerable version, an unauthorized person could change an arbitrary user account from "allow" status to "block" status, or change an arbitrary user account from "block" status to "allow" status. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJT7wsYAAoJEKllVAevmvmsW34H/R+NgzTuSggQlC8D654fZD3j RL37cUifwHUPj4Vfm2LoNlUJDtkpLRFGgj2cpb2T7lgtth45m2SVtVgPteqcztYK vQSEmQxMXt6yxdTahWWGAWFf254glI4OJiG8mpeuqZPByD2T/SiesB0SbzInusqm JYcPH8/0w3jkVkIx7lSz4x2H79+dXIyY1xe9trWVy69X13yz+hMpnjs2i34pWHpe EEr+1gr9H0f+rhfi99nqnT6o1JPRptj/PcFaaR0FNaCwT9SW8h6H5faAhp8urTde qd4SkFTNFOz3PqbwUD+bxbrfC1QlTiFpKqZpsS2qSikBbhU90r58xQjhlF42atY= =dbkG -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ