MovableType before 5.2.6 Vulnerability

2013-06-14 / 2013-06-15

Credit: John Lightsey

Risk: Low

Local: Yes

Remote: No

CVE: CVE-2013-2184

CWE: N/A

CVSS Base Score: 7.5/10

Impact Subscore: 6.4/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: Partial

The 5.2.6 release of MovableType fixed a vulnerability in the handling
of comments to blog posts. The 'comment_state' parameter is processed by
MovableType's unserialize() function which can be used to send data into
Storable::thaw().
As documented by the perl-security team recently, Storable::thaw is
unsafe to use on untrusted inputs.
http://perl5.git.perl.org/perl.git/commit/664f237a84176c09b20b62dbfe64dd736a7ce05e
The MovableType 5.2.6 release notes document the fix for this
vulnerability as:
"109458 Currently un-used parameters are unintentionally deleted when a
comment is posted"
http://www.movabletype.org/documentation/appendices/release-notes/movable-type-526-release-notes.html

References:

http://perl5.git.perl.org/perl.git/commit/664f237a84176c09b20b62dbfe64dd736a7ce05e

http://www.movabletype.org/documentation/appendices/release-notes/movable-type-526-release-notes.html

http://seclists.org/oss-sec/2013/q2/568

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

MovableType before 5.2.6 Vulnerability

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.