Home page logo

oss-sec logo oss-sec mailing list archives

Re: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history
From: cve-assign () mitre org
Date: Tue, 28 Feb 2012 14:18:14 -0500 (EST)

Hash: SHA1

Argh sorry cut and paste the wrong CVE # into novell's bugzilla. Can
we just remove it from there please?

Removing Comment 4 from
https://bugzilla.novell.com/show_bug.cgi?id=749036 is definitely a
good idea, but MITRE will also do a REJECT of the CVE-2006-7248
identifier to address the issue more completely.

We often see vendors of CVE compatible products and services picking
up new CVE mappings from oss-security postings, and from references
cited in oss-security postings, and this often happens on the day of
the posting. Some vendors primarily just want the mapping, and aren't
really investigating the issues or possible discrepancies. So, here,
it's plausible that:

  1. Vendor already discovered the web page for "Bug 749036 - VUL-0:
     kadu: allows to inject js code."

  2. Vendor quickly skimmed the text of 749036 and saw "use
     CVE-2006-7248 for this issue." Vendor did not bother to go to the
     openssl-dev link, or even consider that openssl-dev is not a
     common forum for discussing Kadu.

  3. Vendor immediately jumped to the conclusion that CVE-2006-7248 is
     assigned to the Kadu issue, and updated a data set that
     ultimately gets pushed out to their customers.

  4. Sometime in the future, their customer decides to look up
     CVE-2006-7248 on the MITRE CVE web site.

  4a. If CVE-2006-7248 is a regular CVE entry about an OpenSSL
      vulnerability, the customer might reach any of a variety of
      incorrect conclusions, especially because Kadu apparently uses
      OpenSSL through the QCA OSSL plugin for libqca2. The customer
      might, for example, infer that CVE-2006-7248 is an unpatched
      vulnerability affecting the Kadu EncryptionNgPlugin component.

  4b. If CVE-2006-7248 is a rejected CVE entry that points to the
      correct CVE identifiers for the Kadu issue and the OpenSSL
      issue, then there's probably more hope that the customer will
      find the correct information.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S S145
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/obtain_id.html ]
Version: GnuPG v1.4.11 (SunOS)


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]