Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Jul 2013 16:36:55 -0400
From: Andrew Nacin <nacin@...dpress.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: Open Source Security <oss-security@...ts.openwall.com>, Jay Turla <shipcodez@...il.com>, 
	nacin@...dpress.org
Subject: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws

On Thu, Jul 18, 2013 at 4:25 PM, Kurt Seifried <kseifried@...hat.com> wrote:
> This was brought to my attention by Jay Turla <shipcodez@...il.com>,
> after some searching I found:
>
> http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html
>
> and after testing (it works). So please use:
>
> CVE-2013-4144 swfupload KedAns-Dz object injection
> CVE-2013-4145 swfupload KedAns-Dz XSS
> CVE-2013-4146 swfupload KedAns-Dz CSRF

CVE-2013-4145 (XSS) is actually CVE-2012-2399. And, CVE-2013-4146
(CSRF) seems to be just the potential for CSRF via XSS -- don't think
this is a separate issue.

Neither of those are reproducible in
https://github.com/wordpress/secure-swfupload.

We're aware of CVE-2013-4144 and intend to fix it soon, but it's
really tough to classify "image injection" as a serious vulnerability
without there being any actual XSS there to further trick the user.

> Also alerting WordPress.

Thank you.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.