Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 30 Mar 2010 18:34:37 -0400
From: Anthon Pang <anthon.pang@...il.com>
To: oss-security@...ts.openwall.com
Cc: cert@...t.org, soc@...cert.gov
Subject: Re: phpmyvisites 2.3

On Tue, Mar 30, 2010 at 5:41 PM, Steven M. Christey
<coley@...us.mitre.org>wrote:

>
> On Wed, 10 Mar 2010, Henri Salo wrote:
>
>  There is a security vulnerability in phpMyVisites 2.3. Is there a CVE
>> assigned for that issue?
>>
>> http://www.phpmyvisites.us/phpmv2/CHANGELOG
>>
>
> Use CVE-2009-4763
>
> Notes:
>
> 1) SourceForge has recently made it difficult/impossible to obtain
> changelogs for new releases, so I can't find any information on the December
> release of ClickHeat to get more details.
>
> 2) Consequently, it could be that phpMyVisites is fixing an old ClickHeat
>   problem (CVE-2008-5793) but neither is it clear if that ClickHeat is
>   even the same product.
>
>
> - Steve
>

It appears to be a different issue.

ClickHeat's primary developer denies this is a ClickHeat vulnerability:

https://sourceforge.net/tracker/?func=detail&aid=2916809&group_id=181196&atid=896225

And states that the vulnerability requires the attacker to already have
elevated privileges (application-level admin access in PMV).

-- Anthon

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.