Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request: W3 Total Cache - public cache exposure
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 28 Dec 2012 22:35:44 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/28/2012 01:04 AM, Jason A. Donenfeld wrote:
Hi Kurt,

W3 Total Cache:
http://wordpress.org/extend/plugins/w3-total-cache/

CVE request for three separate issues:

1. Cache allows directory listing of hash-key listings, exposing
hash keys.

As I understand it this is more of an .htaccess type issue than an
actual issue with W3 total cache? Is this documented anywhere in the
W3 total cache documents?

2. Hash keys are easily predictable, in the case of (1) not
existing.

explanation/algorithm/?

3. Cached database values are downloadable by their hash keys on
the public internet, exposing sensitive information like password
hashes.

Do they need to be downloadable? That is to say can these hash values
be protected, or must they be exposed?

Fixing (3) mitigates (1) and (2), so assign this either three CVEs
or one CVE.

Source: http://seclists.org/fulldisclosure/2012/Dec/242

The vendor, copied on this email, currently has not issued a fix.

Thanks, Jason

Thanks in advance, with more details I will be able to properly assign
the CVE identifier(s).


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQ3oEwAAoJEBYNRVNeJnmTcl4P/ipw4D+IzvSLdwYkNOxmGJkZ
Nk0w7iJRk/vHtWgbvCP3OGlFr66gTN1cfk3Rye/ED0kwV0Sy+dEqmblsXCTwmx3G
glC+4sADmQ0AcePVgvWnYv6K5oHgINs7NuPbSsWwdVF+BQCXykYOOYXYpBERkRjX
+CZVEuhMqy4xTi/sgcQiHB4iHZtSLjLB8OOh9+THUsmqf65H3urgPWJbAzOaudxY
PR4+McAKMz0dpshzQVDyZMcSduQBmjhXRCW0RinEyekFshZnvDbk3wkMb+6/Wk36
ekSE/3/zmLIvoRu0iZBhOeLFUNT+oSZfa8AQmMs++Z8huyTI9OjAPxXrlRAdnbHA
0V9/41exnPOwq0W3QKsPzOz0YsRImFo+qfC6KWt77ZsgWfjkWB64l4XmSvhe3U2o
ywoi8XFTuI5e6z/0GAW5zpa/EYqCqV44mCMHYocU8CXzLaXGqbIHv9VK7JH77X2u
RRUIF9sDN/vRej987Fp7MhQgK7cFtRRNECLipe3jeJE3cY9egHMTGfDh+N/3Bg0+
8d5ekkwZAtoDePfFJo7aGwY/CDFxS7izMxwb8nUM0iQUfoukLWdgS/PQmCX9EOcb
tDzDD4Odw36SaN4k5f9fd0CSn0f6+LsPybE/BHDQmJ9mZaK73CcrwIU8s0IoIEOG
An9aPfHyvuiPILuGSgWe
=h95j
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault