Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 02 Mar 2013 20:43:40 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Salvatore Bonaccorso <carnil@...ian.org>,
        Damien Regad <damien.regad@...ckgroup.com>
Subject: Re: CVE request: MantisBT before 1.2.13 "Change Status
 To" feature allows unauthorised workflow changes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/01/2013 11:33 AM, Salvatore Bonaccorso wrote:
> Hi Kurt
> 
> Noticed that the following CVE request did not got a CVE. Would it be
> possible to assign a CVE to this?
> 
> On Sat, Jan 19, 2013 at 11:35:06AM +1100, David Hicks wrote:
>> Hello again list,
>>
>> Damien Regad (MantisBT developer) discovered and fixed[1] an access
>> control/permissions bug in MantisBT that exists in MantisBT version
>> 1.2.12 and prior.
>>
>> A MantisBT user with "Reporter" permissions (enabling them to
>> report/create new issues) can modify the workflow status of any issue to
>> "New" even if they do not have the necessary permission to make this
>> change.
>>
>> Details of the bug, including steps to reproduce and patches are
>> available at [1].
>>
>> References:
>> [1] http://www.mantisbt.org/bugs/view.php?id=15258
>>
>> As per previous e-mails to this list within the past 24 hours, MantisBT
>> 1.2.13 is expected to be released early next week.
>>
>> Can a CVE ID please be assigned to this issue?

Please use CVE-2013-1811 for this issue.

regarding the past email ctrl-c, ctrl-v, same thing right?

>> With thanks,
>> David Hicks
>> MantisBT Developer
>> #mantisbt irc.freenode.net
>> http://www.mantisbt.org/bugs/
> 
> Regards,
> Salvatore
> 


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRMsbsAAoJEBYNRVNeJnmTJywP/iekMslqs479EEQAXadz7AVT
wUxFBMZyalKBUTBQBfBh484ImReFR5zPnnJwOzgf8zn5U/CZLDF49kOCGvYvxlXM
Gd1Z3s+xtc54zhJOhrEpLKn3jYbSVNx1/Xi9SY2DNsgE9356MopuZFYZMqh3aIpH
F2F6Z7a1LGuLbH3s1FRpWsGvJLtD7H4Y+ORmNpQyxOMy+Y4IsvyKeP/SXXAnX3Mu
FMBnip1brK9uw8crHiZCJuSsGHCmvQZ6om/YGNFvjDJb8Z8MvQMX6uyIPZS3BgQT
tc4dqI8YPrmDBjAVKii44av2YPuA++LdwKp0+sgI2A9+ctMtI3zGgbiDPRBglpC8
QYrZrqK3vfPbl4BQH8iHzwUqz1bSD8LsluE+5GQKDvhXEeN3ruFWHwGmOUdv2wdI
ZqUScEJE4ZWBLlsReaZzNvVVNdJh1dwhdEuBMFt+Z0rFRgF6CKH4KdjlI/L2XOQT
FIsib+BlNuuHPvfTBLs0WlzYIjjt/vFMRKQj2OxFl+8YzIQTfvm/gwTtObaBU9Hq
Tkx43du+fPcE6zyCoNHc8D89hHQ3YNJM2Vnmpr2EEuh4bXb+ihGocdn/+ScLNNPf
7e2iavcD1Uq0EaL1ODW3cSaX0RjAilB2/7hx83unlNp1DQvt0RlAGheDG+V5JIOr
p5Fq3w8XmTsO0tVkfH6t
=fGdi
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.