lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <201403141114.s2EBEQvZ017819@sf01web1.securityfocus.com>
Date: Fri, 14 Mar 2014 11:14:26 GMT
From: craig.arendt@...atumsecurity.com
To: bugtraq@...urityfocus.com
Subject: Multiple Vulnerabilities in SeedDMS < = 4.3.3

Product description:
============
SeedDMS is the continuation of LetoDMS because it has lost its main developer. SeedDMS is an easy to use but powerful Open Source Document Management System.
http://www.seeddms.org/index.php?id=2
============

SeedDMS Unprivileged User Remote Code Execution Vulnerability (CVE-2014-2278):
============
Missing Function Level Access Controls: The application will allow file uploads of any type without sufficient user access controls.

Any unprivileged user, including guest users can upload arbitrary file types, including script formats that will allow remote code execution on the server.

Details:
----------------------
The /op/op.AddFile2.php upload function is not sufficiently access controlled. The script path can be controlled using the “fileId” parameter, which will allow an attacker to control the location of files to be uploaded to the system.  Using path traversal a user can traverse out of the configured upload path, and insert arbitrary files into the web root.

The ‘partitionIndex’ parameter is used for filename/extension specification in the path.

The CVE project assigned CVE-2014-2278 to this issue.
============


SeedDMS Path Traversal Vulnerability (CVE-2014-2279):
============
A user can use path traversal methods to return the contents of local files.

To exploit this vulnerability requires privileged access to the LogManagement application functionality.

Details:
----------------------
The /out/out.LogManagement.php script will allow local files to be retrieved from the server by path traversal using the ‘logname’ parameter.

The CVE project assigned CVE-2014-2279 to this issue.
============


SeedDMS Cross-site Scripting Vulnerability (CVE-2014-2280)
============
The application search feature is vulnerable to reflected cross-site scripting attacks.

Details:
----------------------
The ‘query’ parameter will accept scripting tags, which will be returned to the page without validation, or sanitization of HTML entities.

The CVE project assigned CVE-2014-2280 to this issue.
============


Vendor Response:
Upgrade to SeedDMS 4.3.4 or higher.
https://sourceforge.net/projects/seeddms/files/seeddms-4.3.4/

Timeline:
============
February 26, 2014, Vulnerability identified
February 26, 2014, Product vendor notification
February 26, 2014, Product vendor patch review
February 27, 2014, Product vendor fix confirmed
February 28, 2014, Patch released
March 14, 2014, 2014, Disclosure

Research:
============
Craig Arendt, Stratum Security
http://www.stratumsecurity.com

Disclaimer: 
----------------------
The information provided in this advisory is provided as is without warranty of any kind.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ