Date: Tue, 04 Oct 2011 14:05:00 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com Subject: CVE-2011-3979 being duplicate of CVE-2011-3352 Hello Steve, Josh, originally the CVE identifier of CVE-2011-3352 has been assigned:  http://www.openwall.com/lists/oss-security/2011/09/09/5 has been assigned to the following flaw:  http://www.securityfocus.com/archive/1/519565/30/0/threaded  https://www.htbridge.ch/advisory/xss_in_zikula.html Later CVE-2011-3979 has been assigned: Name: CVE-2011-3979 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3979 [Open URL] Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20111003 Category: Reference: BUGTRAQ:20110907 XSS in Zikula Reference: URL:http://www.securityfocus.com/archive/1/archive/1/519565/100/0/threaded [Open URL] Reference: MISC:https://www.htbridge.ch/advisory/xss_in_zikula.html [Open URL] Reference: CONFIRM:http://community.zikula.org/index.php?module=News&func=display&sid=3075 [Open URL] Reference: BID:49491 Reference: URL:http://www.securityfocus.com/bid/49491 [Open URL] Reference: OSVDB:75226 Reference: URL:http://osvdb.org/75226 [Open URL] Reference: SECUNIA:45884 Reference: URL:http://secunia.com/advisories/45884 [Open URL] Reference: XF:zikulaapplication-index-xss(69644) Reference: URL:http://xforce.iss.net/xforce/xfdb/69644 [Open URL] Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php. The security focus link URL in the second assignment is slightly different, but the content of that post seems to be the same. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3352 suggests there are three ways / attack vectors, how to exploit this: a) via specially-crafted 'themename' parameter in 'setasdefault.php' script, b) via specially-crafted 'themename' parameter in modify theme script and, c) via specially-crafted 'themename' parameter in delete theme script. So since CVE-2011-3979 description explicitly mentions 'set as default', should this (CVE-2011-3979) identifier be considered to refer only to 'set as default' case (a) in the above) or are the CVE-2011-3352 and CVE-2011-3979 just CVE duplicates for the same issue? If the latter holds, which is the correct one (assuming the higher one is valid, thus CVE-2011-3979) to use for issue referencing purposes? Thanks && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.