lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <DAE743A0-A094-475D-94FE-C7AB1CE53811@Christian-Schneider.net>
Date: Sun, 7 Sep 2014 18:15:17 +0100
From: Christian Schneider <mail@...istian-Schneider.net>
To: bugtraq@...urityfocus.com
Subject: CVE-2014-5392   XML eXternal Entity (XXE) in "JobScheduler"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


CVE-2014-5392
===================
"XML eXternal Entity (XXE)" (CWE-611) vulnerability in "JobScheduler" product


Vendor
===================
Software- & Organisations-Service GmbH


Product
===================
"JobScheduler is a workload automation tool. It is used to launch JobScheduler objects, 
such as jobs and/or orders, at the occurrence of time, file or calendar events. JobScheduler 
was recognised in 2012 by Gartner Inc. with a placement in their Magic Quadrant for workload 
automation. JobScheduler provides solutions from simple to complex scheduling scenarios. 
It is available with an open source or a commercial licence."
 - source: http://www.sos-berlin.com/modules/cjaycontent/index.php?id=osource_scheduler_introduction_en.htm


Affected versions
===================
This vulnerability affects versions of JobScheduler prior to 1.7.4241 
as well as versions prior to 1.6.4246.


Patch
===================
The vendor has released patches for versions 1.7.x and 1.6.x at 
http://www.sos-berlin.com/modules/news/article.php?storyid=73
http://www.sos-berlin.com/modules/news/article.php?storyid=74


Reported by
===================
This issue was reported to the vendor by Christian Schneider (@cschneider4711) 
following a responsible disclosure process.


Severity
===================
High


Description
===================
Using a specially crafted request to access the web interface of JobScheduler it is possible 
to cause denial of service situations as well as list directories and contents of (sensitive) 
files from the filesystem of the server which has the JobScheduler web interface installed.


Proof of concept
===================
Due to the responsible disclosure process chosen and to not harm unpatched systems, 
no concrete exploit code will be presented in this advisory.


References
===================
http://www.sos-berlin.com/modules/news/article.php?storyid=73
http://www.sos-berlin.com/modules/news/article.php?storyid=74
http://www.christian-schneider.net/advisories/CVE-2014-5392.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)

iEYEARECAAYFAlQMj9cACgkQXYAsOfddvFOj9QCgg/hPe645bRJD8ZZ2E1yIWBMZ
rQQAnR9gZq7TOhZZxAD6tbZ3WHfsqjDq
=HlF4
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ