Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 24 Aug 2012 22:29:42 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Henri Salo <henri@...v.fi>, Moritz Muehlenhoff <jmm@...ian.org>
Subject: Re: CVE-request: Roundcube XSS issues


On Mon, 20 Aug 2012, Kurt Seifried wrote:

>> 2, Issue 2a: Description: Stored XSS in e-mail body. Ticket:
>> http://trac.roundcube.net/ticket/1488613 Upstream patch:
>>
>> [snip]
>>
>> Issue 2b: Self XSS in e-mail body (Signature). Ticket:
>> http://trac.roundcube.net/ticket/1488613 Upstream patch:
>[snip]
>
> Please use CVE-2012-3508 for these two issues (same version, same type
> of vuln so cve merge).

Further investigation into ticket 1488613 shows that the developer thinks 
that issue 2b doesn't need a backport to 0.7.  This would suggest a SPLIT 
based on different affected versions.

Plus it's not immediately clear whether this "self XSS" is really an XSS 
or not - if I can modify my own signature, then I already have the 
"privileges" on my browser to run script.  But, if this "self XSS" is 
really just reflected XSS, then that's a security issue to worry about. 
This requires expertise in the Roundcube codebase to answer for sure, 
though.

So, we should probably SPLIT this CVE.

CVE-2012-3508 - Issue 2a - Stored XSS in e-mail body

(new) CVE-2012-4668 - Issue 2b - Self XSS in e-mail body (Signature)

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.