Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 5 Sep 2012 18:25:09 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
cc: Lukas Reschke <lukas@...tuscode.ch>
Subject: Re: Re: CVE - ownCloud


On Sat, 1 Sep 2012, Kurt Seifried wrote:

> - -------------
> Version 4.0.6 Aug 1th 2012
>
> Security: Check for Admin user in
> appconfig.php (CSRF)
> Registered user could change app configs without admin rights.
> https://github.com/owncloud/core/commit/9605e1926c6081e88326bf78a02c1d1b83126c4f
> Security: Several CSRF security fixes
> The admin settings and the bookmark app wasn't checking the CSRF token.
> https://github.com/owncloud/core/commit/38271ded753bc9ea9943cef3c2706f8d71f3a58f
> and
> https://github.com/owncloud/core/commit/93579d88dcea389205c01ddf6da41f37ad9b8745
>
> CVS merged into a single CVE
>
> Please use CVE-2012-4393 for these issues.

Our interpretation is that this line item is not CSRF:

   "Registered user could change app configs without admin rights"

It's a permissions/authorization problem.  It's made WORSE by CSRF, but 
even without CSRF, a registered user could do something they shouldn't.

So, we assigned CVE-2012-4752 for "Registered user could change app 
configs without admin rights"


> Version 4.0.5 July 20th
> Reflected XSS (XSS)
> The filelist wasn't sanitzing HTML values in image files.
> https://github.com/owncloud/core/commit/d203fa2c50f4b2791e68e2b8ab9a0f8b94f9c9f8
>
> Please use CVE-2012-4394 for this issue.

The 4.0.5 changelog at http://owncloud.org/changelog/ also says "Several 
CSRF security fixes"

So, we assigned CVE-2012-4753 for the CSRF fixed by 4.0.5.

- Steve

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.