Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 18 Jul 2014 13:30:34 -0400 (EDT)
From: cve-assign@...re.org
To: thoger@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, gmollett@...hat.com,
        kseifried@...hat.com
Subject: Re: CVE request - Snoopy incomplete fix for CVE-2008-4796

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> 2002
> http://sourceforge.net/p/snoopy/bugs/13/
> 
> It seems this allowed the most simple injections:
>   https://example.com;id
>   https://example.com/foo.html;id
> 
> Fixed in 2004 via:
> http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.11

Use CVE-2002-2444.


> 2008
> ...
> Followed by a similar fix for headers few days later, which probably
> was not picked up by folks backporting the above commit as the fix for
> this CVE:
> http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27

Use CVE-2008-7313 for this vulnerability involving headers. This issue
exists because of an incomplete fix for CVE-2008-4796.


> 2014

> http://mstrokin.com/sec/feed2js-magpierss-0day-vulnerability-not-really-it-is-actually-cve-2005-3330-cve-2008-4796/

Use CVE-2014-5008. This issue exists because of an incorrect fix for
CVE-2008-4796 (i.e., use of escapeshellcmd where escapeshellarg was
required).


> https://github.com/cogdog/feed2js/pull/12#issuecomment-48283706

Use CVE-2014-5009. This issue exists because of an incorrect fix for
CVE-2014-5008.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTyVl2AAoJEKllVAevmvmsVmgH/i8/r/RQYS5Bu/vzlDVjZbK/
vIjD4rUuUOJ+A75GOR5IjsHg0Ybh5nvx4eTHCTeQhFsNibKUqn8n6SIJlghbtx3C
H2rSGAN4B1+F/xa/3qTU0CAqsear/UqlwCbyD/VvSuS6plYYfk24/UcmDFZ7+N6P
fIf0JAx+0pBWB74s3BdMcSbJNW/19hVMF4vRfsmirTQUn9yjXlB8QyAEVsqw2qSU
T18YscFWBTrB2ifYBD14ku7wK+EFUBNdSsq2/Hykxroka+n2maZVJUpZmpEFSfzZ
jKtciy2Vw/lj/JuCZb02yqL3Lzjph6AYjNWjcbUWtXNPXajiYNMD85PsAtwhkBw=
=hYe5
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.