bugtraq - BMC-2015-0005: File inclusion vulnerability in "BIRT Viewer" servlet used in BMC Remedy AR Reporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 23 Sep 2015 22:36:47 +0000
From: appsec <appsec@....com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: BMC-2015-0005: File inclusion vulnerability in "BIRT Viewer" servlet
 used in BMC Remedy AR Reporting

------------------------------------------------------------------------
File inclusion vulnerability in "BIRT Viewer" servlet used in BMC Remedy 
AR Reporting
 
BMC Identifier: BMC-2015-0005
CVE Identifier: CVE-2015-5071
------------------------------------------------------------------------
By BMC Application Security, SEP 2015
 
------------------------------------------------------------------------
Vulnerability summary
------------------------------------------------------------------------
A security vulnerability has been identified in BMC Remedy 
AR Reporting.
 
The vulnerability can be exploited remotely allowing navigation to 
any local or remote file.

------------------------------------------------------------------------
CVSS v2.0 Base Metrics
------------------------------------------------------------------------
Reference:	
CVE-2015-5071

Base Vector:					
(AV:N/AC:L/Au:S/C:P/I:N/A:N) 	

Base Score:
4.0

------------------------------------------------------------------------
Affected versions
------------------------------------------------------------------------
The flaw has been confirmed to exist in BMC Remedy AR 8.1 and 9.0. 
Earlier Versions may also be affected
 
------------------------------------------------------------------------
Resolution
------------------------------------------------------------------------
A hotfix as well as a workaround are available at
 
https://kb.bmc.com/infocenter/index?page=content&id=KA429507
 
------------------------------------------------------------------------
Credits
------------------------------------------------------------------------
Credit for discovery of this vulnerability: Stephan Tigges from tigges-security.de

------------------------------------------------------------------------
Reference
------------------------------------------------------------------------
CVE-2015-5071
 
Information about BMC's corporate procedure for external vulnerability 
disclosures is at http://www.bmc.com/security

-----BEGIN PGP MESSAGE-----
Version: GnuPG v2

owGtVm1oHEUYTpqkaVYXrxjyowY7REhM2vvIkdhkY3veHWe5xoZ6F84IFZzbm70b
u7tzzM7eh8WKWI1GFLFRtBVaEaQtpbX40WIgYim0NOAX4g+bYoVYaVMQrZpKK/ru
XRO9/PDX7p+bm5l9P573eR72VbmhblX9+83TJ64tXJ+sn5lP16UaulWvS48sPUh1
gqip6rZFmYkKtm4SjtNUp6IM+6gjEk+MohQlRcI7kEV4QScC2RbJOKeRrVGUIAbJ
lJEshROwzjMuqJmVJdhwTuMZYgqqUcIV57Y3GOjt9wYCgX5ZiqZiNcfwv3rcH9jQ
K0vu9RgpVwoN5/M6VbFw+kwS1ebQ4nqUjG1DTtZKxe7lTNUAadmGgXnZzQRhGEa1
h2VDy2ELpQkxEV3E9v9H5at0Ppojy+Ko2IQ4iJTyOqMCgnBiMEH0MsK6zorwJjJx
gWargAoGQbBZRjpTsY4Yv3UdaUAwSOFm69FUMokKQV8ARbBF0FYiOFUtNzMkiEY4
MVWitFR4+l9eAp+crCmiCsaVFueRpXvDKWXEH44qD/nDtpL0R5Vt/rizo4x0o5al
l5Iq40SRpT5fwF1IwpoG9cCQCoQ7QnYVDYcbmo6L/1JLZaZGOZDJmTspUUssoxgQ
bMDXi7CZQYO+gA+4EcNcB5kDbtUCkYEdJlnMIRm+Vb7LIkwQi+m2w093lZdjQqMl
BGgUia47vxgVGd+BObOhY8yhowKmOk6DuWJR6SonRN5S/P4daV/aUH0qM/zU1JgK
GiUclhlSCuVxlmwEbAVsdtLMxuFwX3AQWOcyLFFOMlS4SpFqSKSB7jPUUhnQsIyY
hkSOWrW+oqCkIPkcmMsozWaJhTTODCQqa++ipfkyxF19LAnaXR+qMQaYURwmyo2q
I+I0s4WjiS4L9MLBbTHYYZ7DyDM2MMTBipRg+Cb4Za31ypIDos4suGchQBAL5PAH
6NNaLBaXCLQI14v17Y119avqVjatcL4O6qQWz+Inw8HNzX/jFevbtvjbd0/0vfbN
OLoZ+Gxfz9p1ezqN2OTlxu7Q6m+vL0wP/zXWOnv84fTF9z49K91/bG//s5+3XYtm
z2/Qfnlg5ezcmpHBo+qXW868ceqTyWc+2Pv9/osvb78QWn2p9NH44+cu3ffxxM7f
fvzzxpkndodeGZLW/Dz/1q5DA2OPep6KHb974YXHhk9emJvYZH94x+YvvuuYPss6
zX13nY73NHad2xk99vw7gaEjL03d1nOAPSIP3LPp3VPGnN3Q6W3+Ou05cf4r7832
t3dtP/THwu308Mmrwde7f9rjx0OHg/vHn2ydOjpzhTb+oF9uGz1wYz4y9ntTk+f0
1JXZmaueN+8M/ZpaS57uan7uYO4f
=XWhq
-----END PGP MESSAGE-----