bugtraq - ZoneMinder Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080826125312.1336.qmail@securityfocus.com>
Date: 26 Aug 2008 12:53:12 -0000
From: filip.palian@...stk.edu.pl
To: bugtraq@...urityfocus.com
Subject: ZoneMinder Multiple Vulnerabilities

ZoneMinder Multiple Vulnerabilities

by Filip Palian <filip (dot) palian (at) pjwstk (dot) edu (dot) pl>

Software affected: ZoneMinder <= 1.23.3

Severity: Critical

Description (from the vendor site):
ZoneMinder is an integrated set of applications which provide a complete surveillance solution allowing capture, analysis, recording and monitoring of any CCTV or security cameras attached to a Linux based machine.

Overview:
ZoneMinder is prone to Command Injection, SQL Injcetion and XSS. All attacks are possible because of lack of user input sanitizing.

I. Command Injection
In the "zm_html_view_events.php" function executeFilter() doesn't validate user input.
In the "zm_html_view_state.php" parameter "run_state" is not validated.

II. SQL Injcetion
In the "zm_html_view_event.php" array "filter" is not validated.

III .XSS
In the "zm_html_view_*.php" multiple XSS exists.

Status:
At the moment no fixes were provided by the vendor. As a workaround restricted access to authenticated users only and granting the lowest privileges is suggested.

Disclousre timeline:
18 VI   2008 Vulerability sent to the vendor.
18 VI   2008 Initial vendor response.
26 VIII 2008 Security bulletin released.

Link:
http://www.zoneminder.com/

Best regards,
Filip Palian.