Date: Thu, 4 Jun 2015 16:48:15 -0400 (EDT) From: cve-assign@...re.org To: mattd@...fuzz.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE requests / Advisory: phpMyBackupPro -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > * CVE-2009-4050 = original fully-arbitrary file download > * New 2009 CVE = incomplete fix in 2.2(?) (adding a file extension whitelist) > * New 2015 CVE = incomplete fix in 2.5 (adding a filename suffix blacklist) We haven't been able to figure out why another CVE-2009- ID would be needed. The year portion of a CVE ID typically refers to when the vulnerability became publicly known, not (for example) when the vulnerability was introduced. Before this year, apparently nobody had disclosed that there was a vulnerability in version 2.2 or later in which a .php file, but not an arbitrary file, could be downloaded. Also, the phpMyBackupPro doc/HISTORY.txt doesn't have any entries that we would consider sufficiently close to a disclosure of that .php download vulnerability. So: CVE-2009-4050 = original fully-arbitrary file download (the known affected version is 2.1) CVE-2015-4180 = download of specific configuration files with a ../../files/filename.php request (the presumed affected versions are at least 2.1 through 2.4) (other files with approved extensions can also be downloaded, but this is intentional behavior, not part of the vulnerability) CVE-2015-4181 = download of specific configuration files with a ../../files/../files/filename.php request (the presumed affected version are at least 2.1 through 2.5) (again, other files with approved extensions can also be downloaded, but this is intentional behavior, not part of the vulnerability) CVE-2015-4181 exists because of an incomplete fix for CVE-2015-4180. CVE-2015-4180 exists because of an incomplete fix for CVE-2009-4050. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVcLkNAAoJEKllVAevmvmsP1kH/3McXj3rkNn/KdgHBddNj5M9 tnwhb1hDugmZ8H4EqfypexsxELCZ8Wc21OrqSQCdHpGumPZHWGfN5Sa49FlLcz2R ghJ5/O6pLhMYudPS9WByfQmTTSFMSygPCUKNxg5zawulMJTEu3oK+Ra47StOQn+q hEiI9/HqDoGIVr+4gUkyFFyCdFSsDq9hBJFsWWXAzsrIAKBclY+GYpmzxk3bY61Q jgmFMnZyfV9JFw1MPMPR/RZ5PGBjppo2EGO9EaWFg4uhowuNCEhv1CZQi4kTM9sZ 36BLsVbZ78yI38TGyK10nZxfEhlBmMLmOM+/rpBGeWHRLNLK+o6TQJTqvuYdUjE= =PQsw -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.