[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 16 Dec 2009 11:53:08 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Some small KDE issues
On Thu, 10 Dec 2009 22:54:57 -0600 Raphael Geissert
<geissert@...ian.org> wrote:
> > Our KDE maintainer alerted us to this:
> > http://www.ocert.org/advisories/ocert-2009-015.html
> > http://www.kde.org/info/security/advisory-20091027-1.txt
>
> According to 0910291553490.22070@....redhat.com, ids were already requested.
>
> Maybe somebody needs to be prodded?
I'd rather say it needs someone to do the work and clearly state what
should get a CVE and why. Advisory text does not really map well to
the list of patches.
One obvious candidate is "do not allow non-http and non-webdav urls in
XMLHTTPRequests" fix, related to a not-so-ideal application of the same
origin policy on local files. Ark and Kmail are examples where it can
lead to issues, but it does not seem from the upstream advisory there
is an intention to close what was described as the source of the
problem in Portcullis advisories (e.g. not using khtml as a default
previewer in ark, or at least not with enabled javascript sounds
reasonable).
As for the XMLHTTPRequest fix, it should be noted that the restriction
does not seem to be what other browsers do. Mozilla only allows local
files to access other local urls (with the subdir restriction in recent
versions), even using XMLHTTPRequest, but allows no remote access. I've
been told WebKit has a tunable for that and the same restriction should
be the default in recent versions (confirmed in e.g. recent chromium).
Not restricting remote access can still allow stealing data from sites
behind the firewall kind of attacks.
As for KIO slaves issues, Tim posted his list already. For CVE
assignment, they should probably be grouped by the fix time, as not all
of them seem to have been fixed at the same time / version.
So taking this to an account, do you have a proposal for the list of
issue that should get CVE?
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
