[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5304F37E.3030404@stylite.de>
Date: Wed, 19 Feb 2014 19:10:06 +0100
From: Ralf Becker <rb@...lite.de>
To: cve-assign@...re.org, pedrib@...il.com
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request: remote code execution in egroupware <= 1.8.005
Hi,
my remarks to your questions as developer of EGroupware and the fixes
included in 1.8.006:
Am 19.02.14 16:41, schrieb cve-assign@...re.org:
>> I have discovered a remote code execution via php unserialize in egroupware
>> <= 1.8.005.
>
> Use CVE-2014-2027.
>
>> https://github.com/pedrib/PoC/raw/master/egroupware-1.8.005.txt
>> http://www.egroupware.org/changelog
>
>> Security: fixed arbitrary file overwrite and remote code execution
>> reported by Pedro Ribeiro (pedrib@...il.com) of Agile Information
>> Security
>
> We could not immediately determine whether the egroupware-1.8.005.txt
> disclosure means that:
>
> Arbitrary file overwrite in __destruct:
>
> Remote code execution in __destruct:
>
> are both exploitable only as a consequence of unsafe unserialize use.
Removing PHP unserialization removes the thread, as all these values got
not stored. So passing PHP serialized data to 1.8.006 code only gives an
error, as json_unserialize does not understand it.
> If eliminating the unsafe unserialize use would not completely address
> those issues, additional CVE IDs may be needed.
>
> There are no new CVE assignments yet for possible other issues in the
> 1.8.006.20140217 changelog entry, such as:
>
> CalDAV/Calendar: fixed permanent auth request in iCal, if
> accountselection is set to "selectbox with groupmembers" and rights
> granted from group without being a member
This is NOT security relevant, server-side errors / exceptions cause
basic auth requests as a means to show to user something went wrong.
> SiteMgr: fixed not working anonymous user and using now a random
> password
This is a hardening included in 1.8.005 by no longer using a static
password for anonymous user, but setting up a random one during
installation time.
So I dont think further CVE's are needed.
Ralf
--
Ralf Becker
Director Software Development
Stylite AG
Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30
Email: rb@...lite.de
www.stylite.de | www.egroupware.org
Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer
VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany
Download attachment "signature.asc" of type "application/pgp-signature" (899 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
