Date: Sun, 26 Aug 2012 23:32:00 +0400 From: Eygene Ryabinkin <rea-sec@...elabs.ru> To: oss-security@...ts.openwall.com Cc: Henri Salo <henri@...v.fi>, Moritz Muehlenhoff <jmm@...ian.org> Subject: Re: CVE-request: Roundcube XSS issues Mon, Aug 20, 2012 at 10:11:28AM -0600, Kurt Seifried wrote: > On 08/20/2012 05:24 AM, Jan Lieskovsky wrote: > > Upon code review, I don't think this issue affects 0.7.x versions, > > we ship in Fedora and EPEL (iilc the Larry skin was introduced > > only in 0.8.x version and in 0.7.x version the related code looks > > different). That's true: the issue is that the $hkey was used in the ternary operator (copy'n'paste error) and $hkey wasn't initialized at the point, so the condition will be false, thus the 'show' mode will be used. And this code appears only in 0.8-beta and 0.8-rc. 0.8.0 fixes the issue and it doesn't exist in the 0.7.x, because there were no processing for the 'valueof' attribute in rcmail_message_headers(). > > I don't have filed RH bug for this based on the above. > > Could you have a look and confirm this? > > Please use CVE-2012-3507 for this issue. At NVD I see that version specification is "prior to 0.8.0", http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3507 though http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3507 shows only a stub without details. The proper version specification will be "Roundcube from 0.8.x series prior to 0.8.0". -- Eygene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.