Re: CVE Request -- Multiple security issues in various versions of AWStats

["MustLive" <mustlive () websecurity com ua>]

Hi Jan!

You asked about 6 CVE for holes, but there are 7 holes (with two variations 
for holes #2 and #3), which I disclosed (but it's possible to make one CVE 
entry for #4 with two XSS holes). Here is few moments concerning your asking 
about CVE.

1. The holes #1 and #2 was already disclosed earlier, as I stated in my
advisory. I just remind about them for fullness of my advisory and to show
differences between versions of AWStats (that protecting parameter key was
added in version 1.2) and that this parameter can be bypassed. As I show in
examples for holes #2, #3, #5 and #6.

2. As I stated in my advisory, as I tested, for hole #1 (XSS) was vulnerable
version 1.1 build 1.6, but was not vulnerable 1.1 build 1.5 (which shipped
with AWStats 6.0 - from this version I've started using AWStats in 2004).

3. There are CVE entries already for #2 (and should be for #1, but I don't
know about such CVE and I've not found it in CVE database).

Open redirect vulnerability
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-5020

But as I showed in my advisory in case of #2, this fix can be bypassed, so
there can be made update for this CVE entry or made new entry.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----- Original Message ----- 
From: "Jan Lieskovsky" <jlieskov () redhat com>
To: "Steven M. Christey" <coley () linus mitre org>
Cc: <oss-security () lists openwall com>; "MustLive"
<mustlive () websecurity com ua>
Sent: Friday, October 07, 2011 11:17 AM
Subject: CVE Request -- Multiple security issues in various versions of
AWStats


> Hello Josh, Steve, vendors,
>
>   these doesn't look like CVE ids have been already assigned for:
>   [1] https://bugzilla.redhat.com/show_bug.cgi?id=740926#c0
>   [2] http://secunia.com/advisories/46160/
>   [3] http://seclists.org/fulldisclosure/2011/Sep/234
>   [4] http://websecurity.com.ua/5380/
>
> If I counted correctly, six CVE ids should be assigned for these
> (since different versions are listed as vulnerable):
>
> 1) XSS (WASC-08) (in versions <=1.1):
>    http://site/awredir.pl?url=javascript:alert(document.cookie)
>
> 2) Redirector (URL Redirector Abuse in WASC 2.0) (WASC-38):
>    http://site/awredir.pl?url=http://websecurity.com.ua
>
> 3) SQL Injection (WASC-19): (version 1.2)
>    http://site/awredir.pl?url='%20and%20benchmark(10000,md5(now()))/*
>
> 4) XSS (WASC-08) (in version 1.2):
>
>    http://site/awredir.pl?url=%3Cscript%3Ealert(document.cookie)%3C
>    /script%3E
>
>    http://site/awredir.pl?key=%3Cscript%3Ealert(document.cookie)%3C
>    /script%3E
>
> 5) HTTP Response Splitting (WASC-25):
>
>    http://site/awredir.pl?key=04ed5362e853c72ca275818a7c0c5857&;
>    url=%0AHeader:1
>
> 6) CRLF Injection (Improper Input Handling in WASC 2.0) (WASC-20):
>
>    http://site/awredir.pl?key=4b9faa91e2529400c4f3c70833b4e4a5&;
>    url=%0AText
>
> Could you allocate CVE identifiers for these? (let me know
> if further description of each of the issues is necessary prior
> assignment).
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team