Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 13 Apr 2015 15:00:05 -0400 (EDT)
From: cve-assign@...re.org
To: mattd@...fuzz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request / Advisory: Floating Social Bar (Wordpress plugin) 1.0.1 - 1.1.6

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>>   1. Maybe the
>>      "-     add_action( 'wp_ajax_nopriv_fsb_save_order', array( $this, 'save_order' ) );"
>>
>>      code change means that wp_ajax_nopriv_fsb_save_order allowed
>>      bypassing intended access control, even if the attacker did not
>>      supply an XSS payload.

> Yes. It wasn't intended for non-administrators to be able to adjust
> the services by executing the action.

>>
>>   2. Maybe the patched code can help to prevent a CSRF attack against
>>      an authenticated action handler.

> Again, yes. Administrators could be forced to execute the action with
> an attacker's parameters via a CSRF attack. Nonces have been added to
> stop this.

Certainly the CSRF will have its own CVE ID, because it is independent
of whether (and why) wp_ajax_nopriv_fsb_save_order existed.

In this specific case, for the direct unauthenticated attacks, we feel
that there can be two CVE IDs for the two different problems with
different types of attacks, i.e., leaving the services in their
original order but including an XSS payload (CVE-2015-3299), and
moving the services to an arbitrary order but omitting an XSS payload.
These conceivably could have been (even though they weren't) fixed
independently:

  add an effective approach against XSS in the input data, but
  ignore the relationship between the new order values and the
  original order values

  versus

  ensure that the order values, when compared numerically, have no
  change from the original values -- but ignore trailing
  non-numeric data

We will send the additional CVE IDs soon unless there is any new
information.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVLBEIAAoJEKllVAevmvms36QH/jvFVxqbjNQMB3Wis1kX2RaI
ArW32jKwavBxrGEQ5O+OJEGf6tYS27lA9YPiNKp+8Jk5NfRmXgqNOsw+YuCNcV7J
arwVDeIOPRDVmvgANdaNjHQ+fl4xTUqBGClqa0T7ZsGTXjEhkaQIJ4CjYBAulp6J
qGKohKSOCJ9UOQmPWFTD0Pr1gOykfdsF9K5w+LkVcZ3EbS8Is6hnBuOAg3EbbtQp
PZX0Z6ZykonoXQ3sTDdoqV6w6k9qvYP0YrQkKrJvmcLcKjohGyAvcjsyjXh4gEtT
mepqdUI6oGe7b6X97e3WE4wlIcz0R8VZdvZIgmQRQHtTDBzK2eNruZUCsFcfTcE=
=DRJz
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.