oss-security - Request for CVE: Bytemark Symbiosis

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1402050135.3596.16.camel@dynamo>
Date: Fri, 06 Jun 2014 11:22:15 +0100
From: Patrick J Cherry <patrick@...emark.co.uk>
To: oss-security@...ts.openwall.com
Subject: Request for CVE: Bytemark Symbiosis

Symbiosis is an easy to use collection of tools, utilities, and
configuration files for mass hosting virtual domains using Apache, Exim,
Dovecot, PureFTPD, and several other daemons.

The code behind the system is freely available, and it is widely used by
at least one hosting company.  The code itself is available, along with
documentation, here:

    http://symbiosis.bytemark.co.uk/

Unfortunately releases between these two mercurial identifiers contained
a significant flaw:

changeset:   cbb56af035bb
date:        Thu Jun 05 18:54:22 2014 +0100

changeset:   99e920baf1f7
date:        Tue Jul 07 15:27:26 2009 +0100

Attackers could arbitrarily blacklist individual IP addresses in the
firewall using specially crafted usernames, providing a vector for
denial of service attacks.

This flaw was fixed with the following commit:

https://projects.bytemark.co.uk/projects/symbiosis/repository/diff?rev_to=733b0e33f60b&rev=cbb56af035bb

Please could a CVE identifier be allocated such that we may use it in
our documentation.

Thanks

-- 
Patrick J Cherry
Director of operations                        http://www.bytemark.co.uk/
Bytemark Hosting                               tel: +44 (0) 1904 890 890

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.