Debian Bug report logs - #608289
CVE-2010-3905

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Giuseppe Iuculano <iuculano@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2010-3905

Date: Wed, 29 Dec 2010 18:35:59 +0100

Package: eucalyptus
Severity: serious
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for eucalyptus.

CVE-2010-3905[0]:
| The password reset feature in the administrator interface for
| Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which
| allows remote attackers to gain privileges by sending password reset
| requests for other users.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3905
    http://security-tracker.debian.org/tracker/CVE-2010-3905

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAk0bcX4ACgkQNxpp46476aolcACdEyRVzIIcJcjb3MnpIkIa6U/6
JMAAn2y10CbObsCW/xQxWLkOCyJIq4E6
=IPi5
-----END PGP SIGNATURE-----

Message #10 received at 608289@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: Giuseppe Iuculano <iuculano@debian.org>, 608289@bugs.debian.org

Cc: Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: [pkg-eucalyptus-maintainers] Bug#608289: CVE-2010-3905

Date: Fri, 31 Dec 2010 23:45:26 +0900

tag 608289 + moreinfo
thanks

Le Wed, Dec 29, 2010 at 06:35:59PM +0100, Giuseppe Iuculano a écrit :
> Package: eucalyptus
> Severity: serious
> Tags: security
> 
> CVE-2010-3905[0]:
> | The password reset feature in the administrator interface for
> | Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which
> | allows remote attackers to gain privileges by sending password reset
> | requests for other users.

Dear Giuseppe and Eucalyptus packagers,

Do you know if this bug also affects Eucalyptus 1.6.2 ? If not, we can close
it, since Debian does not distribute 2.0.0 or 2.0.1, and since I suppose that
we will jump directly to 2.0.2 or later when we will upgrade the package.

Have a nice day,

-- 
Charles Plessy
Tsurumi, Kanagawa, Japan

Message #17 received at 608289@bugs.debian.org (full text, mbox, reply):

From: Neil Soman <neil@eucalyptus.com>

To: Charles Plessy <plessy@debian.org>, "608289@bugs.debian.org" <608289@bugs.debian.org>

Cc: Giuseppe Iuculano <iuculano@debian.org>, Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: [Debian] [pkg-eucalyptus-maintainers] Bug#608289: Bug#608289: CVE-2010-3905

Date: Fri, 31 Dec 2010 07:59:41 -0800

Folks, this regression was introduced in the 2.0 series and does not
affect Eucalyptus 1.6.2 to the best of my knowledge.

neil



On Dec 31, 2010, at 6:51 AM, Charles Plessy <plessy@debian.org> wrote:

> tag 608289 + moreinfo
> thanks
>
> Le Wed, Dec 29, 2010 at 06:35:59PM +0100, Giuseppe Iuculano a écrit :
>> Package: eucalyptus
>> Severity: serious
>> Tags: security
>>
>> CVE-2010-3905[0]:
>> | The password reset feature in the administrator interface for
>> | Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which
>> | allows remote attackers to gain privileges by sending password reset
>> | requests for other users.
>
> Dear Giuseppe and Eucalyptus packagers,
>
> Do you know if this bug also affects Eucalyptus 1.6.2 ? If not, we can close
> it, since Debian does not distribute 2.0.0 or 2.0.1, and since I suppose that
> we will jump directly to 2.0.2 or later when we will upgrade the package.
>
> Have a nice day,
>
> --
> Charles Plessy
> Tsurumi, Kanagawa, Japan
>
>
>
> _______________________________________________
> pkg-eucalyptus-maintainers mailing list
> pkg-eucalyptus-maintainers@lists.alioth.debian.org
> http://lists.alioth.debian.org/mailman/listinfo/pkg-eucalyptus-maintainers

Message #22 received at 608289@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: 608289@bugs.debian.org

Cc: Giuseppe Iuculano <iuculano@debian.org>, Debian Bug Tracking System <control@bugs.debian.org>

Subject: Re: [Debian] [pkg-eucalyptus-maintainers] Bug#608289: Bug#608289: CVE-2010-3905

Date: Sun, 2 Jan 2011 00:50:17 +0900

tag 608289 - moreinfo
done 608289
thanks

Le Fri, Dec 31, 2010 at 07:59:41AM -0800, Neil Soman a écrit :
> Folks, this regression was introduced in the 2.0 series and does not
> affect Eucalyptus 1.6.2 to the best of my knowledge.

Thanks for the information, I am closing the bug accordingly.

Have a nice year 2011 !

-- 
Charles

Message #29 received at 608289-submitter@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: control@bugs.debian.org

Cc: 608289-submitter@bugs.debian.org

Subject: closing 608289

Date: Sun, 02 Jan 2011 00:53:16 +0900

close 608289 
thanks
-- 
Charles Plessy
http://charles.plessy.org
Tsurumi, Kanagawa, Japan

Send a report that this bug log contains spam.