Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 26 Jun 2010 10:42:25 +0200
From: Morten Shearman Kirkegaard <>
To: Florian Streibelt <>
Cc: oss-security <>, Jan Lieskovsky
 <>, "Steven M. Christey" <>,
 Michael Fleming <>, Mads Martin Joergensen
 <>, Christoph Thiel <>, Ben Schmidt
Subject: Re: CVE Request -- mlmmj -- Directory traversal flaw by editing
 and saving  list entries via php-admin web interface

CC'ing Christoph Thiel (mlmmj-php-admin author) and Ben Schmidt (current
mlmmj maintainer).

On Wed, 2010-06-23 at 19:41 +0200, Florian Streibelt wrote:
> when I reported the bug I had no time to further investigate and I think I
> did not report upstream because of lack of time at that point and later
> forgot - which is sad.

Yeah, well, things like that happen. Would you agree that the attached
patch fixes the vulnerability?

Using a list of known-good-characters would be nice, but dot happens to
be a valid character in a list name.

> The php webinterface is a third-party development for mlmmj but part of the
> official release.

I know that this is just semantics, but... While it is true that the
mlmmj-php-admin web interface is distributed along with mlmmj, it is not
a part of mlmmj itself, but is located in the contribs directory.

Best regards,

Morten Shearman Kirkegaard <>

View attachment "patch-mlmmj-php-admin-dirtravfix.diff" of type "text/x-patch" (1139 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.