Bug 371314 (CVE-2011-2190)

Summary:	<www-servers/cherokee-1.2.99: Multiple vulnerabilities (CVE-2011-{2190,2191})
Product:	Gentoo Security	Reporter:	Tim Sammut (RETIRED) <underling>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	alexanderyt, bass, glsamaker, matsuu, www-servers+disabled
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~4 [noglsa]
Package list:		Runtime testing required:	---

Description Tim Sammut (RETIRED) gentoo-dev

2011-06-12 21:14:35 UTC

Week password generation, CVE-2011-2190:
http://code.google.com/p/cherokee/issues/detail?id=1212

Persistent XSS and CSRF, CVE-2011-2191:
http://www.openwall.com/lists/oss-security/2011/06/03/6

Comment 1 Stefan Behte (RETIRED) gentoo-dev

2011-10-08 13:25:18 UTC

*** Bug 386257 has been marked as a duplicate of this bug. ***

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2011-10-08 13:25:45 UTC

CVE-2011-2190 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2190):
  The generate_admin_password function in Cherokee before 1.2.99 uses time and
  PID values for seeding of a random number generator, which makes it easier
  for local users to determine admin passwords via a brute-force attack.

Comment 3 MATSUU Takuto (RETIRED) gentoo-dev

2011-10-13 02:25:52 UTC

1.2.99 in cvs.
CVE-2011-2191 is also fixed in 1.2.99

Comment 4 Tim Sammut (RETIRED) gentoo-dev

2011-10-13 13:40:40 UTC

(In reply to comment #3)
> 1.2.99 in cvs.
> CVE-2011-2191 is also fixed in 1.2.99

Great, thank you. Closing noglsa for ~arch only package.