Date: Mon, 13 Apr 2015 15:00:05 -0400 (EDT) From: cve-assign@...re.org To: mattd@...fuzz.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> 1. Maybe the >> "- add_action( 'wp_ajax_nopriv_fsb_save_order', array( $this, 'save_order' ) );" >> >> code change means that wp_ajax_nopriv_fsb_save_order allowed >> bypassing intended access control, even if the attacker did not >> supply an XSS payload. > Yes. It wasn't intended for non-administrators to be able to adjust > the services by executing the action. >> >> 2. Maybe the patched code can help to prevent a CSRF attack against >> an authenticated action handler. > Again, yes. Administrators could be forced to execute the action with > an attacker's parameters via a CSRF attack. Nonces have been added to > stop this. Certainly the CSRF will have its own CVE ID, because it is independent of whether (and why) wp_ajax_nopriv_fsb_save_order existed. In this specific case, for the direct unauthenticated attacks, we feel that there can be two CVE IDs for the two different problems with different types of attacks, i.e., leaving the services in their original order but including an XSS payload (CVE-2015-3299), and moving the services to an arbitrary order but omitting an XSS payload. These conceivably could have been (even though they weren't) fixed independently: add an effective approach against XSS in the input data, but ignore the relationship between the new order values and the original order values versus ensure that the order values, when compared numerically, have no change from the original values -- but ignore trailing non-numeric data We will send the additional CVE IDs soon unless there is any new information. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVLBEIAAoJEKllVAevmvms36QH/jvFVxqbjNQMB3Wis1kX2RaI ArW32jKwavBxrGEQ5O+OJEGf6tYS27lA9YPiNKp+8Jk5NfRmXgqNOsw+YuCNcV7J arwVDeIOPRDVmvgANdaNjHQ+fl4xTUqBGClqa0T7ZsGTXjEhkaQIJ4CjYBAulp6J qGKohKSOCJ9UOQmPWFTD0Pr1gOykfdsF9K5w+LkVcZ3EbS8Is6hnBuOAg3EbbtQp PZX0Z6ZykonoXQ3sTDdoqV6w6k9qvYP0YrQkKrJvmcLcKjohGyAvcjsyjXh4gEtT mepqdUI6oGe7b6X97e3WE4wlIcz0R8VZdvZIgmQRQHtTDBzK2eNruZUCsFcfTcE= =DRJz -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.