Bug#659899: CVE-2012-0790: XSS

2013-03-17 Thread Tobias Oetiker
Folks, Yesterday Steven Chamberlain wrote: Hi! On 16/03/13 21:53, Salvatore Bonaccorso wrote: On Sat, Mar 16, 2013 at 10:47:54PM +0100, Salvatore Bonaccorso wrote: [...] But how about the attached patch for unstable? Thank you for that. It does seem like the right way to handle it

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Adam D. Barratt
On Sat, 2013-03-16 at 12:40 +, Steven Chamberlain wrote: Control: reopen -1 [...] squeeze is vulnerable, as seen on the Navigator Graph page by changing the displaymode in the URL. It gets echoed back by this: Bug reopened No longer marked as fixed in versions smokeping/2.6.7-1. Is

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Salvatore Bonaccorso
Control: fixed -1 2.6.7-1 Hi Steven On Sat, Mar 16, 2013 at 12:40:04PM +, Steven Chamberlain wrote: Control: reopen -1 Hmm, as Adam wrote, was this intentional? Because this way we lost the version tracking for already fixed version. BTS handles fixed versions already. Btw, it's a nice

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Steven Chamberlain
Hi, On 16/03/13 13:56, Adam D. Barratt wrote: On Sat, 2013-03-16 at 12:40 +, Steven Chamberlain wrote: No longer marked as fixed in versions smokeping/2.6.7-1. Is that really what you meant to do? I can't remember now, so it was probably a mistake, but now I can think of a reason to

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Antoine Beaupré
Control: found -1 2.6.7-1 Control: fixed -1 2.6.9-1~exp0 Control: fixed -1 2.3.6-5+squeeze1 Control: tags -1 pending Control: block -1 with 703193 On 2013-03-16, Salvatore Bonaccorso wrote: Control: fixed -1 2.6.7-1 Hi Steven On Sat, Mar 16, 2013 at 12:40:04PM +, Steven Chamberlain

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Salvatore Bonaccorso
Hi Antoine Dropping Tobias Oetiker again from Cc, don't know if he is actually interested to follow this. But we might/should bring further issues with smokeping to him. On Sat, Mar 16, 2013 at 12:42:39PM -0400, Antoine Beaupré wrote: Control: found -1 2.6.7-1 Control: fixed -1 2.6.9-1~exp0

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Salvatore Bonaccorso
On Sat, Mar 16, 2013 at 10:47:54PM +0100, Salvatore Bonaccorso wrote: Hmm, this will quite sure not be approved. And Jonathan Wiltshire already commented there. A new upstream version at this stage of the freeze is not acceptable. But how about the attached patch for unstable? ... which I

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Steven Chamberlain
Hi! On 16/03/13 21:53, Salvatore Bonaccorso wrote: On Sat, Mar 16, 2013 at 10:47:54PM +0100, Salvatore Bonaccorso wrote: [...] But how about the attached patch for unstable? Thank you for that. It does seem like the right way to handle it for wheezy. Your patch seems correct to me. But

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Steven Chamberlain
Another difference is that upstream 2.6.9 used a replacement character of underscore rather than a dot. Attached is my suggested revision of Salvatore's patch (also adds filtering of time specifiers). I've tested this on an existing wheezy/sid SmokePing installation; it stops the injection of

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Antoine Beaupré
On 2013-03-16, Steven Chamberlain wrote: Another difference is that upstream 2.6.9 used a replacement character of underscore rather than a dot. Attached is my suggested revision of Salvatore's patch (also adds filtering of time specifiers). I've tested this on an existing wheezy/sid

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Steven Chamberlain
Control: reopen -1 Hi, squeeze is vulnerable, as seen on the Navigator Graph page by changing the displaymode in the URL. It gets echoed back by this: return divERROR: unknown displaymode $mode/div I'm not convinced the 'blacklist characters' approach was a great way to handle it, but at

Bug#659899: CVE-2012-0790: XSS

2013-03-16 Thread Steven Chamberlain
On 16/03/13 12:40, Steven Chamberlain wrote: and the generated HTML contains: IMG id=zoom BORDER=0 width=697 height=315 SRC=/smokeping/images/__navcache/136343653521739_now oops _1363423440.png Fortunately though, it doesn't seem possible to use an equals sign in these parameters, and so