oss-sec mailing list archives
Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version
From: Ralf Schlatterbeck <rsc () runtux com>
Date: Sat, 10 Nov 2012 13:28:41 +0100
On Sat, Nov 10, 2012 at 06:54:46AM -0500, Jan Lieskovsky wrote:
[A] * issue2550729: Fix password history display for anydbm backend, thanks to Ralf Hemmecke for reporting. (Ralf) [3] http://issues.roundup-tracker.org/issue2550729 [D] * Fix wrong execute permissions on some files, thanks to Cheer Xiao for the patch. (Ralf) Cc-ed Ralf Schlatterbeck on this post too to clarify, if issues [A] and [D] would also have security implications / IOW if those would be security flaws too. Ralf please clarify. Thank you, Jan.
[A] Doesn't have security implications if roundup is correnctly configured. The bug would create a python backtrace. Unless the "debug" option in section [web] is set (which is explicitly discouraged) this will only display "an error has occurred" in the web-interface. Even if someone sets the debug option in a production release only the hashed password could be disclosed. Note that this bug only affects the anydbm backend which should not be used for a production version either. [D] No security implications: Fixed some permissions on files in roundup/cgi and locale directories. These are not accessible via the web-server. So this doesn't constitute a remote vulnerability. Local users don't gain anything executing these files as no privilege escalation is involved (they could copy the file which is readable anyway and make their local copy executable). Ralf -- Dr. Ralf Schlatterbeck Tel: +43/2243/26465-16 Open Source Consulting www: http://www.runtux.com Reichergasse 131, A-3411 Weidling email: office () runtux com osAlliance member email: rsc () osalliance com
Current thread:
- CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Ralf Schlatterbeck (Nov 10)
- Re: CVE Request -- roundup: Multiple XSS flaws plus other security related fixes corrected in upstream 1.4.20 version Jan Lieskovsky (Nov 10)