Re: CVE request: Apache Axis2 Session Fixation

[Marcus Meissner <meissner () suse de>]

On Tue, Jul 06, 2010 at 04:49:41AM -0500, security curmudgeon wrote:
> : there has recently been a Session Fixation vulnerability reported in Apache 
> : Axis2, see:
> : 
> : References:
> : https://issues.apache.org/jira/browse/AXIS2-4739
> : http://www.securityfocus.com/archive/1/511955/30/30/threaded
> : 
> : There is already CVE-2010-2103 assigned for the Cross-Site Scripting 
> : mentioned in the advisory above. However, there does not seem to be a 
> : CVE for the Session Fixation flaw, so could you possibly assign one for 
> : it too?
>
> Can we also get a CVE assigned for the other 186 issues I found in 
> issues.apache.org dating back to 2002-03-04? CVE covers 73 of the 259 
> issues, some much more serious than session fixation in Axis.
>
> On a more serious note, does it have to be posted to Bugtraq or F-D to get 
> attention here?
> If you search osvdb.org by reference for 
> "issues.apache.org", you will see a substantional amount of 
> vulnerabilities that are higher risk (e.g., auth bypass, XSS, arbitrary 
> file disclosure, cleartext password disclosure, etc). Consider there were 
> almost two dozen more vulnerabilities that didn't get added to OSVDB 
> because the bug reports were too vague, inconclusive and/or the Apache 
> staff never responded in any fashion to clarify the severity or verify the 
> report. If we had more time to actually dig into the report / code, they 
> likely would have been added. 
>
> I am not entirely sure why this one is important enough to warrant an 
> individual request to CVE for assignment, when much more serious issues 
> exist, some of which are still oustanding last I checked.
>
> If CVE does assign an entry to this, please assign one to OSVDB 58803 for 
> an Apache Wicket Session Fixation issue too. Thanks!


Basically a CVE naming authority or CVE needs to be told somehow of the issue.

No one will just go to bugtrackers and add CVEs randomly.

So there are usually external references to the bugs.

There is no reason why the bugs could not get CVE entries, it however really
helps if you have a list of 1 or more URLs per-issue prepared, as the database
is filled out by humans ;)

288 is however a massive amount and probably going back the history is not
that useful either.

Ciao, Marcus