oss-security - Re: CVE request: remote code execution via deserialization in XStream

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 10 Jan 2014 10:07:57 +1000
From: David Jorm <djorm@...hat.com>
To: cve-assign@...re.org
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request: remote code execution via deserialization in XStream

On 01/10/2014 09:46 AM, cve-assign@...re.org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>> http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
> Use CVE-2013-7285.
>
> At least initially, the scope of this CVE is "XStream is an
> 'reflection-based XML-to-Object conversion'" in that file, and all of
> the implications of unrestricted conversion, including "allows the
> creation of server side objects based on reflection (which means that
> you could have all sorts of business-logic sensitive objects being
> created)" -- which is mentioned separately in that file.
>
> If this does not make sense, and multiple CVEs are needed, please let
> us know.
>
> - -- 
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (SunOS)
>
> iQEcBAEBAgAGBQJSzzPZAAoJEKllVAevmvms3cEH/3MBAH57R/LhQfI5ZMUm9FOD
> eZm7p9IGl3PpSMtrwqSNwXS6InpfAmc04P0xX/HM4yFSRX6yHVaTZA9vbNGRs6PV
> VdZg/A+WiUwdBdGhsFfXCb82QvCthdxyv6AAK5uNpVqQTqmikVPNk8gYxcHXZz3+
> xUmUGLxwlCtImSZ1WiZMSCMYul3jsFsuOiVlqHF2NBoXh+55xmy8hLTOCUijILeG
> lAXfMo25S971OJalr5pzGUC2EPUclV5D08+jv3KCNqryNphsepa3+14OKrvvz1yX
> Q19c3+suDKWOUDvur9ENeHkf//Va881GNGZkcvppfvIkYCMI3vKFaWGMYRWR+jE=
> =Jkgd
> -----END PGP SIGNATURE-----

That makes sense, and I think a single CVE ID is all that is needed in 
this case.

Thanks
David

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.