Re: CVEs for wordpress 3.4.2 release

[Andrew Nacin <nacin () wordpress org>]

On Wed, Sep 12, 2012 at 1:04 PM, Kurt Seifried <kseifried () redhat com> wrote:

> On 09/12/2012 04:38 AM, Hanno Boeck wrote:
> > I can't find CVEs assigend for the issues fixed in wordpress
> > 3.4.2.
> >
> > http://wordpress.org/news/2012/09/wordpress-3-4-2/
> >
> >
> > Sadly, the information is quite limited: "Version 3.4.2 also fixes
> > a few security issues and contains some security hardening. The
> > vulnerabilities included potential privilege escalation and a bug
> > that affects multisite installs with untrusted users. These issues
> > were discovered and fixed by the WordPress security team."
> >
> > I suggest assigning two: 1. potential privilege escalation 2.
> > problem with untrusted users on multisite installations unless
> > someone has more information.
>
> Can security () wordpress org provide clarification on this please?


The second one there is CVE-2012-3383. 3.4.1 remained affected; fixed in
3.4.2.

We are more specific on our version pages. From
http://codex.wordpress.org/Version_3.4.2:

 * Fix unfiltered HTML capabilities in multisite (this is CVE-2012-3383)
 * Fix possible privilege escalation in the Atom Publishing Protocol
endpoint
 * Allow operations on network plugins only through the network admin

Details for the other two:

 * AtomPub allowed contributors to publish posts, which is normally reserved
for users of an author role or higher. This should be considered low risk,
low
impact. An additional mitigating factor is that AtomPub is off by default
and
rarely enabled. (In WordPress 3.5, AtomPub will no longer be a part of
core.)

 * For multisite, plugins that must be activated network-wide could be
activated by a non-network administrator. This is only if they were already
installed by a network administrator, but left inactive. This could also
only
occur if the network administrator allowed individual site administrators to
manage plugins -- by default, this is not the case, and it is rare. Again,
not
particularly high risk or impact.

Regards,

Andrew Nacin
Lead Developer
WordPress