oss-security - Re: CVE requests / Advisory: phpMyBackupPro

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu,  4 Jun 2015 16:48:15 -0400 (EDT)
From: cve-assign@...re.org
To: mattd@...fuzz.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE requests / Advisory: phpMyBackupPro

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> * CVE-2009-4050 = original fully-arbitrary file download
> * New 2009 CVE = incomplete fix in 2.2(?) (adding a file extension whitelist)
> * New 2015 CVE = incomplete fix in 2.5 (adding a filename suffix blacklist)

We haven't been able to figure out why another CVE-2009- ID would be
needed. The year portion of a CVE ID typically refers to when the
vulnerability became publicly known, not (for example) when the
vulnerability was introduced. Before this year, apparently nobody had
disclosed that there was a vulnerability in version 2.2 or later in
which a .php file, but not an arbitrary file, could be downloaded.
Also, the phpMyBackupPro doc/HISTORY.txt doesn't have any entries that
we would consider sufficiently close to a disclosure of that .php
download vulnerability.

So:

  CVE-2009-4050 = original fully-arbitrary file download
                  (the known affected version is 2.1)


  CVE-2015-4180 = download of specific configuration files
                  with a ../../files/filename.php request (the
                  presumed affected versions are at least 2.1 through
                  2.4)

                  (other files with approved extensions can also be
                  downloaded, but this is intentional behavior, not
                  part of the vulnerability)


  CVE-2015-4181 = download of specific configuration files
                  with a ../../files/../files/filename.php request
                  (the presumed affected version are at least 2.1
                  through 2.5)

                  (again, other files with approved extensions can
                  also be downloaded, but this is intentional
                  behavior, not part of the vulnerability)
              

CVE-2015-4181 exists because of an incomplete fix for CVE-2015-4180.
CVE-2015-4180 exists because of an incomplete fix for CVE-2009-4050.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVcLkNAAoJEKllVAevmvmsP1kH/3McXj3rkNn/KdgHBddNj5M9
tnwhb1hDugmZ8H4EqfypexsxELCZ8Wc21OrqSQCdHpGumPZHWGfN5Sa49FlLcz2R
ghJ5/O6pLhMYudPS9WByfQmTTSFMSygPCUKNxg5zawulMJTEu3oK+Ra47StOQn+q
hEiI9/HqDoGIVr+4gUkyFFyCdFSsDq9hBJFsWWXAzsrIAKBclY+GYpmzxk3bY61Q
jgmFMnZyfV9JFw1MPMPR/RZ5PGBjppo2EGO9EaWFg4uhowuNCEhv1CZQi4kTM9sZ
36BLsVbZ78yI38TGyK10nZxfEhlBmMLmOM+/rpBGeWHRLNLK+o6TQJTqvuYdUjE=
=PQsw
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.