[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <fd8ae002-bf60-d687-8d52-2a00378b1713@foxmole.com>
Date: Wed, 17 May 2017 22:08:25 +0200
From: Stefan Pietsch <stefan.pietsch@...mole.com>
To: <oss-security@...ts.openwall.com>
CC: <fulldisclosure@...lists.org>
Subject: Re: Dolibarr ERP & CRM - Multiple Issues
On 10.05.2017 10:28, FOXMOLE Advisories wrote:
> === FOXMOLE - Security Advisory 2017-02-23 ===
>
> Dolibarr ERP & CRM - Multiple Issues
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Affected Versions
> =================
> Dolibarr 4.0.4
>
> Issue Overview
> ==============
> Vulnerability Type: SQL Injection, Cross Site Scripting,
> Weak Hash Algorithm without Salt, Weak Password Change Method
> Technical Risk: critical
> Likelihood of Exploitation: medium
> Vendor: Dolibarr
> Vendor URL: https://www.dolibarr.org/
> Credits: FOXMOLE employees Tim Herres and Stefan Pietsch
> Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
> Advisory Status: Public
> OVE-ID: OVE-20170223-0001
> CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888
> CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886
> https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887
> https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888
> CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759
> CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
--- snip ---
Here is a small update to our security advisory.
An additional CVE ID got assigned for the password change finding:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8879
Meanwhile the Dolibarr developers fixed more possible SQL injection bugs
in this git commit:
https://github.com/Dolibarr/dolibarr/commit/fa290c34fad108ec7c0751c0372ae9c4b4f63b06
They still didn't release a fixed version of the Dolibarr software.
For CVE-2017-7886 I don't agree with the CVSS v2 scoring from the NIST.
They rated "Confidentiality Impact" as partial while I think it is
complete as we have full access to all tables.
Regards,
Stefan
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
