oss-security - Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities (clearing up confusion)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 27 Dec 2013 11:24:15 +0100
From: Jordi Sanfeliu <jordi@...ranet.cat>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities (clearing up confusion)

Hi,

Following the suggestion from Brian Martin (Open Security Foundation), I 
write here to try to clear up things [1] related to the latest security 
vulnerabilities that affected the Monitorix built-in HTTP server.

In 20-Nov-2013 Jacob Amey from Security Inspection, Inc. opened a new 
issue #30 [2] exposing the three different security vulnerabilities he 
found. One of them was classified as High while the last two were as 
Medium.

In 21-Nov-2013 I released the new 3.3.1 version fixing the first one, 
that is the one that was classified as High. The security vulnerability 
was described as "Arbitrary Command Execution" and the function affected 
was 'handle_request()'. I left the other two vulnerabilities to be fixed 
in the next 3.4.0 version that was almost ready to be released.

In 02-Dec-2013 I released the new 3.4.0 version which included fixes for 
the remain two security vulnerabilities discovered by Jacob Amey in the 
same issue #30.

These two security vulnerabilities fixed in 3.4.0 were described as "Web 
Server Generic Cookie Injection" and "Web Server Generic XSS" as stated 
in the issue #30 and the function affected was again 'handle_request()'. 
[3]

Since it seemed that the fact I put a link in the news pointing to BID 
63913 added some confusion, I've recently updated the news in the 
Monitorix web site to make things as clear as possible. [4]

Thank you very much.
Best regards.

[1] <http://seclists.org/oss-sec/2013/q4/442>
[2] <https://github.com/mikaku/Monitorix/issues/30>
[3] 
<https://github.com/mikaku/Monitorix/commit/cc9ba672bbf3015aef69f0053209ece81eb6d934>
[4] <http://www.monitorix.org/news.html#N340>

-- 
Jordi Sanfeliu
FIBRANET Network Services Provider
http://www.fibranet.cat

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.