Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 20 Aug 2008 12:16:41 -0400 (EDT)
From: "Steven M. Christey" <>
Subject: Re: wordpress 2.6.1

On Tue, 19 Aug 2008, Hanno [utf-8] Böck wrote:

> Just had a look at the wp 2.6.1 changelog.
> Two security relevant bugs are listed as fixed.
> I'd consider this worth a CVE. It's good that this ssl stuff got some
> attention lately (I think this is a similar issue to the recently reported
> cookie / secureflag issues, as it can undermine the sniffing-safety of
> ssl-enabled pages).

It's hard to read into this one since I don't know what they mean by
"SSL-aware" here, or what apply_filters() is intended to do.

Use CVE-2008-3747, to be filled in later.

> AFAICS this enables one to hide malicious plugins but is no real vuln. Not
> sure if it deserves a CVE.

Presumably, only the admin would be able to install plugins.  So plugin
"hiding" isn't feasible.  The admin knows which plugins were installed,
unless there's some other exploit that installs the plugins, in which case
there's a different vuln.  So I don't think this deserves a CVE either.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.