Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 6 Dec 2010 17:13:02 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: vanilla forums before 2.0.10, xss


On Mon, 6 Dec 2010, Josh Bressers wrote:

> Use CVE-2010-4264 for the XSS. The commit is here:
> https://github.com/vanillaforums/Garden/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece
>
> As for the "linkbait" issue, I have no clue. Nothing in git seems to
> point at that.
>
> Steve, does MITRE have a precedent for such a thing?

The vendor is calling it a "vulnerability" which is good enough to assign 
a CVE to, as a different vuln type than XSS.

My guess is that it's open redirect, which is used to redirect users away 
from the site towards spam or malware.  Just a guess, though.

- Steve


>
> Thanks.
>
> -- 
>     JB
>
>
> ----- "Hanno Böck" <hanno@...eck.de> wrote:
>
>> Hi,
>>
>> http://vanillaforums.org/discussion/13119/vanilla-2.0.10-released/p1
>>
>> Two sound like security:
>> #
>> # Added SafeStyles configuration to prevent XSS linkjacking
>> # Patched potential linkbait vulnerability in dispatcher
>>
>> (although I don't know what a linkbait vulnerability is, maybe someone
>> wants
>> to enlighten me)
>>
>> --
>> Hanno Böck                Blog:                http://www.hboeck.de/
>> GPG: 3DBD3B20                Jabber/Mail:        hanno@...eck.de
>>
>> http://schokokeks.org - professional webhosting
>
>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.