Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: zoneminder: local file inclusion vulnerability
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 20 Feb 2013 23:59:58 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/19/2013 02:47 AM, Salvatore Bonaccorso wrote:
Hi

In zoneminder forum the following announce was done already in
2011:

http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979

Stupid Q, is there like an official security page? POsting stuff to a
forum is not exactly the easiest place to find things, can they setup
like zoneminder.com/security/ and at least list all the security
issues and link to them there so people don't have to dig through the
forums?

I say this because this is the first cve request I've ever seen for
zoneminder since I started assigning, and indeed, since 2008, so I'm
guessing there's a few more missing ones......

If someone wants to big through the forums to find them and post them
here that would probably be helpful (seriously, wanna pad your resume
and get a reference from me? first person to make 100 good CVE
requests wins).

where zoneminder is prone to a local file inclusion vulnerability. 
From upstream versions prior to 1.24.4 are affected and the issue
was fixed in 1.24.4 and 1.25.0.

SVN commits fixing this issue for the 1.24.x versions are r3483
and r3488, and patches:

http://www.zoneminder.com/downloads/lfi-patch.txt 
http://www.zoneminder.com/downloads/lfi-patch2.txt

I haven't found a CVE assigned to this already. In case I did not
miss something, could you allocate a CVE for this issue?

Debian Bug: http://bugs.debian.org/700912

Please use CVE-2013-0332 for this issue.

Regards, Salvatore


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRJcXuAAoJEBYNRVNeJnmTxIAP/RppcXyl48K0o/7PRBeLBc5J
ShUjF0h2tZc5RDNcjDDyeESkcHCeT9iI1IGdXe0xN4sLIGnUcwEV8TsRVHiwP0lw
FYr1hDKn/OII2bwokCcvg60HN4BOzU0ZGyL/EhBMlv+eU+HsGEtZeKUqaEWTr3FS
39zXzkfFHd0SRfqye1FSVA4magi7f4bY58gu74dhd/uchu7+Hf8+NEyRsN2Nw8aM
bSEENydNsVS4xuihsmsPr6FD+FGPSI8D+HXAHyzYkp+WS9sSx+Sv1nsDQ/T4N1Tn
DYB/U+3x8QO2naf43uKh9GEtseTWtZTfCMghm6Bjh2ocbNDKHvhzF5jGa7/I9Yie
KQGLzPxvJkN45qJ/b8Lse0jPe6aQjJfFifzYQG0tNxGFF97A9hMynTGyRIPW+nNA
Jxnc4fKwPvGbqGbixEpHAUsmnR6IBFWOBzBbv8sUgiwYAzAPzuj/+97LMjD5cchJ
a/Et6jrbn2c/4n6241YjKsOe/TY/sK/NT/HtnksqM5A0RaElnelEbkSPt/9jZi0+
ncqAJ0Ta8HbptZCcuuI/xSGIHiANucQQfIFJp+w9Gb8yXfNRIP7GOvlgvryf9ZFR
wJN/+KPklkEPO/Xdpsp6bnilVN8gVKfZnf5o6WucBQGXKsiKLpEjIdWjn//6wXrH
2b8Gicemt1WgV6/F0tKV
=axec
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]