| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 2 Oct 2017 18:14:47 +0300 From: John Torakis <johntorakis@...sus-labs.com> To: oss-security@...ts.openwall.com Cc: fulldisclosure@...lists.org, bugtraq@...urityfocus.com Subject: [FD] CVE-2017-9807: e2openplugin-OpenWebif: Remote code execution through HTTP GET parameter manipulation Hello all, e2openplugin-OpenWebif is an open source web interface plugin for IP TVs and media centers. It is found in several IP TV software images and hardware products including the commercial Dreambox devices. A remote code injection vulnerability was found in the "key" HTTP GET parameter of the "/api/saveconfig" API call. Further analysis of the vulnerability can be found here: https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/ The vulnerability allows remote code execution on hosts running the aforementioned plugin. Some devices affected also run the plugin under root privileges (e.g: Dreambox DM800 HD se), allowing for complete remote takeover of the host. This defect has been patched by the vendor with the git commit: 09a050c8f04afd3bb4a14af98994be255aae10d9 (https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/commit/09a050c8f04afd3bb4a14af98994be255aae10d9). Administrators of affected devices are strongly advised to update their running instance of e2openplugin-OpenWebif to the latest version of the code. An official release containing the fix has not been released yet. References: https://github.com/E2OpenPlugins/e2openplugin-OpenWebif/issues/620 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9807 https://census-labs.com/news/2017/10/02/e2openplugin-openwebif-saveconfig-remote-code-execution/ Disclosure Timeline: Vendor Contact: June 21st, 2017 CVE assignment: June 22nd, 2017 Vendor Patch: September 15th, 2017 Public Advisory: October 2nd, 2017 Regards, -- John Torakis Security Researcher CENSUS S.A. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists