FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mantis -- multiple vulnerabilities

Affected packages
mantis < 1.2.11

Details

VuXML ID 55587adb-b49d-11e1-8df1-0004aca374af
Discovery 2012-06-09
Entry 2012-06-12
Modified 2012-06-13

Mantis reports:

Roland Becker and Damien Regad (MantisBT developers) found that any user able to report issues via the SOAP interface could also modify any bugnotes (comments) created by other users. In a default/typical MantisBT installation, SOAP API is enabled and any user can sign up to report new issues. This vulnerability therefore impacts upon many public facing MantisBT installations.

Roland Becker (MantisBT developer) found that the delete_attachments_threshold permission was not being checked when a user attempted to delete an attachment from an issue. The more generic update_bug_threshold permission was being checked instead. MantisBT administrators may have been under the false impression that their configuration of the delete_attachments_threshold was successfully preventing unwanted users from deleting attachments.

References

CVE Name CVE-2012-2691
CVE Name CVE-2012-2692
Message http://sourceforge.net/mailarchive/forum.php?thread_name=1339229952.28538.22%40d.hx.id.au&forum_name=mantisbt-dev
Message http://www.openwall.com/lists/oss-security/2012/06/09/1