| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <007b01c3a9cb$ead1a950$496480c1@vegetab1e.org> Date: Thu, 13 Nov 2003 09:52:57 -0000 From: "advisories" <advisories@...saire.com> To: <bugtraq@...urityfocus.com> Subject: Corsaire Security Advisory: PeopleSoft PeopleBooks Search CGI multiple argument issues -- Corsaire Security Advisory -- Title: PeopleSoft PeopleBooks Search CGI multiple argument issues Date: 04.07.03 Application: PeopleTools 8.20/8.43 and prior Environment: Various Author: Martin O'Neal [martin.oneal@...saire.com] Audience: General distribution Reference: c030704-010 -- Scope -- The aim of this document is to clearly define several issues in the argument handling functionality of the PeopleSoft PeopleBooks Search CGI application, as supplied by PeopleSoft Ltd. [1]. -- History -- Discovered: 01.07.03 (Martin O'Neal) Vendor notified: 04.07.03 Document released: 12.11.03 -- Overview -- The PeopleSoft PeopleBooks component provides a CGI based search application as part of the default installation. Several of the attributes that are passed into the CGI application allow the specification of a server-side path. By entering various path values into this argument it is possible to: - Access arbitrary files outside of the web servers document root. - Cause a Denial of Services (DoS) on the web server host. -- Analysis -- The Search CGI application (psdoccgi.exe) is used within the PeopleBooks online documentation. This application accepts two arguments, headername and footername, that allow the selection of header and footer content to be returned as part of the search results HTML page. These arguments appear to be checked for basic formatting issues, however it is still possible to access files outside of the web server root, such as configuration files, that may contain passwords or other confidential information. -- Recommendations -- PeopleSoft have released details of this and other issues under security rollup vulnerability ID 20031112, which is available to registered users from the PeopleSoft support site [2]. PeopleSoft recommends that customers address the vulnerability by applying the following fixes available on PeopleSoft Customer Connection. Release Patch 8.18 8.18.15 8.19 8.19.12 8.20 8.20.03 8.42 8.42.14 8.43 8.43.11 For those who can not implement the patches promptly, as a mitigating strategy a firewall or other HTTP filtering device can be used to block queries containing sensitive strings, or as a last resort all access to the PeopleSoft application can be disabled in entirety. -- CVE -- The Common Vulnerabilities and Exposures (CVE) project has assigned Multiple numbers to this issue: CAN-2003-0626 PeopleSoft PeopleBooks Search CGI arbitrary file read issue CAN-2003-0627 PeopleSoft PeopleBooks Search CGI DoS issue These are candidates for inclusion in the CVE list, which standardises names for security problems (http://cve.mitre.org). -- References -- [1] http://www.peoplesoft.com [2] http://www.peoplesoft.com/corp/en/patch_fix/search.jsp -- Revision -- a. Initial release. b. Minor detail revisions. c. Revised to include vendor information. -- Distribution -- This security advisory may be freely distributed, provided that it remains unaltered and in its original form. -- Disclaimer -- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Corsaire accepts no responsibility for any damage caused by the use or misuse of this information. Copyright 2003 Corsaire Limited. All rights reserved.
Powered by blists - more mailing lists