Re: Re: CVE oops in GLSA 201308-05 (wireshark)

[Vincent Danen <vdanen () redhat com>]

* [2013-08-28 14:10:10 -0400] cve-assign () mitre org wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > I just saw via a Gentoo bug report that their GLSA 201308-05 advisory
> > mentioned some CVEs as related to wireshark that were incorrect.
> >
> > Instead of mentioning CVE-2013-{3560,3561,3562} they mentioned
> > CVE-2013-{3540,3541,3542}. I checked on MITRE's site and those three
> > are still reserved.
> >
> > I don't know who those three (354[012]) are assigned to, but you might
> > want to see if they've been used already or not and dupe them against
> > 356[012] if they have not.
>
> Those are in use:
>
> http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0085.html
>
> Airlive
> CVE-2013-3540. Cross Site Request Forgery(CWE-352) and Clickjacking(CAPEC-103)
> CVE-2013-3541. Relative Path Traversal(CWE-23)
>
> Grandstream
> CVE-2013-3542. Backdoor in Telnet Protocol(CAPEC-443)

Ok.  I suspect that Gentoo has or will fix any self-published copies of
their GLSA but the ones that are archived still contain the incorrect
references.  Not sure if you need/want to do anything... I just sent the
email as a heads-up for you.

--
Vincent Danen / Red Hat Security Response Team