Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 19 Jul 2013 00:27:37 -0600
From: Kurt Seifried <>
CC: Andrew Nacin <>,
        "Christey, Steven M." <>,
        Jay Turla <>
Subject: Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities
 Multiple flaws

Hash: SHA1

On 07/18/2013 03:29 PM, Andrew Nacin wrote:
> On Thu, Jul 18, 2013 at 5:10 PM, Christey, Steven M.
> <> wrote:
>> CVE-2012-2399's only public details are that it's an unspecified
>> vulnerability in Wordpress before 3.3.2, yet
>> is pretty
>> vague and mentions multiple products (although it does credit
>> Neal Poole for at least one issue).  That said, a statement by a
>> lead developer of Wordpress is important for this clarification
>> ;-)  Andrew, can you confirm for sure that CVE-2012-2399 is
>> *also* the same as CVE-2012-3414 for Neal Poole's movieName
>> vector?
> Negative, I was mistaken. Sorry for the confusion. CVE-2012-2399
> was a separate XSS, affecting buttonText, and reported by Szymon
> Gruszecki. CVE-2012-3414 was Neal Poole's report, affecting
> movieName.
> So, CVE-2013-4145 is a duplicate of CVE-2012-3414, *not* of
> CVE-2012-2399.
> That said, given that CVE-2012-2399 was not publicly described at
> the time, I would not be surprised if one or more CVEs have been
> issued for the same XSS via buttonText at one point.
> Christey, Steven M. <> wrote:
>> Since swfupload.swf is apparently widely used, researchers may be
>> finding the same issue over and over again in different packages,
>> and presenting them as if they are new.  Yet there might be some
>> attack variants buried in there, too.
>> Because of the amount of attention by researchers who don't check
>> whether an issue has already been disclosed, and/or the number of
>> independent products that use this library, any "new"
>> swfupload.swf issues should be regarded with extreme suspicion
>> while CVE tries to iron out all the existing duplicates.
> Related, for those who haven't seen, WordPress forked SWFUpload
> last month. Both Neal and Szymon have been helping us with the
> fork, as well. At this point, in terms of issues known to us, only
> the image injection issue is unfixed.
> Fork: Post:

So to confirm:

CVE-2013-4144 swfupload KedAns-Dz object injection
CVE-2013-4145 duplicate of CVE-2012-3414
CVE-2013-4146 swfupload KedAns-Dz CSRF

and we're good?

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.