mailing list archives
Re: CVE-request: Dewplayer issues
From: cve-assign () mitre org
Date: Mon, 30 Dec 2013 11:16:25 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE-----
Use CVE-2013-7240 for this dew_file directory traversal issue.
Assigning one CVE for vulnerability in different software components e.g.
libraries used in WordPress plugins makes it very difficult to coordinate
updates with end-users. Examples:
When a vulnerability originally came into existence through a single
action of a single developer, we currently don't like to assign
multiple CVE IDs on the basis of the vulnerable code later being
shipped in many separately maintained products. We can enter an
internal issue report about the effect on CVE usability because of this
"difficult to coordinate" observation.
Just to clarify: the dewplayer.swf file is thought to be essentially
the same in these two cases, and you're asking for two different CVE
IDs to be assigned? It seems very unlikely at this point that we can
provide more than one CVE ID for those, but we just wanted to confirm
that we're answering the right question.
Q: Does content spoofing issues normally get CVE as the risk is probably
If we think the vendor's security policy is that dewplayer.swf should
not be able to reference off-site media files in this way, then the
issue is currently eligible for a CVE assignment. We're not sure that
a spoofing impact would be the primary motivation for changing this.
Perhaps a stronger motivation is that the vendor doesn't want
dewplayer.swf to trigger arbitrary outbound TCP traffic from the web
host, possibly including traffic to intranet servers in some
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
-----END PGP SIGNATURE-----