bugtraq - Multiple Vulnerabilities: LedgerSMB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f5cca7ed0809091802n72ad98d3p1e3edc0d19cd7a6b@mail.gmail.com>
Date: Tue, 9 Sep 2008 18:02:19 -0700
From: "Chris Travers" <chris.travers@...il.com>
To: bugtraq@...urityfocus.com,
	LedgerSMB <ledger-smb-announce@...ts.sourceforge.net>,
	"LedgerSMB Users" <ledger-smb-users@...ts.sourceforge.net>,
	"Development discussion for LedgerSMB" <ledger-smb-devel@...ts.sourceforge.net>
Subject: Multiple Vulnerabilities: LedgerSMB < 1.2.15

Multiple vulnerabilities:  LedgerSMB

Synopsis:  Two vulnerabilities announced in LedgerSMB for versions
prior to 1.2.15
Status:  Corrected in version 1.2.15 and later (vendor fix available).
Impact:  Resource exhaustion on server, arbitrary SQL command execution.
Other software affected:  SQL-Ledger, all versions, and likely related software

Two vulnerabilities have been recently discovered in LedgerSMB which
have been patched in version 1.2.15 and later.

Vulnerability 1:  Resource exhaustion
Problem:  The CGI scripts read the query string up to
$ENV{CONTENT_LENGTH}, allowing for unlimited data in POST operations
to any screen.  Authentication is not required and this can be used to
deny service not only to LedgerSMB but potentially to anything else
running on the server.  This was corrected in 1.2.15.

Credit for discovery:
Chris Murtagh

Vulnerability 2:  SQL Injection in AR/AP Transactions Report
A parameter was not properly validated prior to being included in the
SQL for generating this report.  It would have been possible to inject
arbitrary SQL into the query.  Authentication is required to exploit. This
was corrected in 1.2.15.

Credit for discovery:
Seneca Cunningham