Re: CVE-request: WordPress 3.1.1

[Yves-Alexis Perez <corsac () debian org>]

On mer., 2012-01-18 at 15:22 -0700, Kurt Seifried wrote:
> On 01/15/2012 07:39 AM, Henri Salo wrote:
> > On Sun, Jan 15, 2012 at 03:32:48PM +0100, Hanno Böck wrote:
> > > > 1) Certain unspecified input is not properly sanitised before being
> > > > returned to the user. This can be exploited to execute arbitrary HTML
> > > > and script code in a user's browser session in context of an affected
> > > > site. http://osvdb.org/show/osvdb/72141
> > > I think this is CVE-2012-0287:
> > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0287
> > I think you are correct. I do not know why I did not see this in allitems.txt.gz. Can't find other CVEs with that 
> > URL. There seems to be three issues. I am refering to http://wordpress.org/news/2011/04/wordpress-3-1-1/:
> >
> > "Version 3.1.1 also addresses three security issues discovered by WordPress core developers Jon Cave and Peter 
> > Westwood, of our security team. The first hardens CSRF prevention in the media uploader. The second avoids a PHP 
> > crash in certain environments when handling devilishly devised links in comments, and the third addresses an XSS 
> > flaw."
> >
> > ======================================================
> > Name: CVE-2012-0287
> > Status: Candidate
> > URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0287
> > Phase: Assigned (20120103)
> > Category: 
> > Reference: MISC:http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html
> > Reference: CONFIRM:https://wordpress.org/news/2012/01/wordpress-3-3-1/
> >
> > Cross-site scripting (XSS) vulnerability in wp-comments-post.php in
> > WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows
> > remote attackers to inject arbitrary web script or HTML via the query
> > string in a POST operation that is not properly handled by the
> > "Duplicate comment detected" feature.
> >
> >
> > Current Votes:
> > None (candidate not yet proposed)
> > ======================================================
> >
> > - Henri Salo
> I don't feel assigning a CVE for these issues would be prudent until
> some details are released, I think the 3.1.1 and 3.1.3 stuff is separate
> but I can't be sure. Can someone from WordPress comment?

I was asked to try security () wordpress org so I'm adding them to CC: just
in case. (to security () wordpress org, the thread beginning is at
http://openwall.com/lists/oss-security/2012/01/15/3)

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part