Message-ID: <CAAYo3BsSZkTvpX8ADzo3BBpb_PK+2J8ngC02EH2a4CJs=1ksjA@mail.gmail.com>
Date: Fri, 13 May 2016 15:26:49 +1000
From: David Black <dblack@...assian.com>
To: bugtraq@...urityfocus.com
Subject: May 2016 - HipChat Server - Critical Security Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Note: the current version of this advisory can be found at
https://confluence.atlassian.com/x/96hMMQ .


CVE IDs:
* CVE-2016-3714 - ImageMagick - Insufficient shell characters
filtering leads to (potentially * remote) code execution
* CVE-2016-3715 - ImageMagick - File deletion
* CVE-2016-3716 - ImageMagick - File moving
* CVE-2016-3717 - ImageMagick - Local file read
* CVE-2016-3718 - ImageMagick - SSRF (Server-Side Request Forgery)


Product: HipChat Server.

Affected Hipchat Server versions:
version < 2.0 build 1.4.1

Fixed HipChat Server versions:
Version 2.0 build 1.4.1 of HipChat Server has been released with a fix
for this issue.


Summary:
This advisory discloses a critical severity security vulnerability in
HipChat Server. All versions of HipChat Server before version 2.0
build 1.4.1 are vulnerable.

Hipchat Cloud instances have already been upgraded to a version of
HipChat which does not have the issue described on this page.

Customers who have upgraded HipChat Server to version 2.0 build 1.4.1
or later are not affected.

Customers who have downloaded and installed HipChat Server less than
version 2.0 build 1.4.1

Please upgrade your HipChat Server installations immediately to fix
this vulnerability.


ImageMagick Image Parsing Vulnerabilities including CVE-2016-3714
(Remote Code Execution), CVE-2016-3715, CVE-2016-3716, CVE-2016-3717
and CVE-2016-3718
Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels. The
scale allows us to rank a severity as critical, high, moderate, or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.

Description:

HipChat Server used a vulnerable version of the ImageMagick library
without restricting coders. Attackers who can log in can use the
ImageMagick vulnerabilities in vulnerable versions of HipChat Server
to:

* Execute remote code of their choice
* Delete files that the www-data user has permission to delete
* Move files that the www-data user has permission to move
* Read files that the www-data user has permission to read
* Make http requests to local and internal services

To exploit this issue, attackers need to have a valid account in a
vulnerable HipChat Server instance.

All versions of HipChat Server before version 2.0 build 1.4.1 are
affected by this vulnerability. This issue can be tracked here:
https://jira.atlassian.com/browse/BAM-17099


Fix:

We have taken the following steps to address these issues:
Released HipChat Server version 2.0 build 1.4.1 that contains fixes
for these issues. As of version 2.0 build 1.4.1 -
* HipChat Server checks if a file is a supported image format before
passing the file to the ImageMagick library.
* HipChat Server uses a policy file to disable vulnerable ImageMagick coders.

Remediation:
Upgrade HipChat Server to version 2.0 build 1.4.1 or higher.

Information on upgrading HipChat Server can be found at
https://confluence.atlassian.com/hc/upgrading-hipchat-server-606306347.html.


How do I check which version of HipChat Sever I am running?

You can check which version of HipChat Server you are running by going
to https://your-server/server_admin/upgrade or by using ssh to log in
to your HipChat Server and run cat /etc/hipchat-release.

For a full description of the latest version of HipChat Server, see
https://confluence.atlassian.com/hc/hipchat-server-release-notes-608731400.html.


Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/ .



- --
David Black / Security Engineer.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJXNWUWAAoJECQgl6K8Unag47IP/3KVjVhAUYD5Hdu8hWN2cwHF
X/fyelKzGyXokiQK9TfKQ2K88oV8FLJnEgFGMxliwHZF0v8xj+EukHhf8axFZ1gF
OIqFYk4Ba7igjaqvDewJhcOc9wPhX/eb9vBI8NiZYfcU135DZMV+kU70YthjZ3Ks
V6rw5S/mgAL8HEpLXA0Z4OB4iRUuUwJ+l7OYp0bypKzswS4dpRzh7kIWGotiM3yl
IK0gh6wT47/yZSB0ZFfBq+2oER43gzlK+0bUmp81G/SX4Q6rVbs6SXhl+ASs1+kv
ZspX3qXExbzmcEbArFDgbH94xgvRhz2LGYExS0GKwmn8m0BW67lVq8gqysoi48Zf
UPfVsl7ycoKTE9ndiwvZprJTZQvxaxUhSe5AotgjOLRlsV0qSqdO+C2y5kiDgIQK
cO/RRlxzuTVPgeHixbij4/jr6Et4u2aaRzGrXPLa0jY6UrXohiDO3Tg7lyGe1l5p
OLf6TPym2UTut72og5sdl1W5YDBNfoIHEPooz/J+9DPbH7M+KdZqmB4GRVBiNsR8
8+/Em6mRroCxo0Ftb/wPZnqEVVnIOdKTdkpCdN2hdIWw2RozmTa5AlpMzeGB9XRT
rCaMBKtI0cyEXJJgp+kKpZqLDIXGHxO/FYCfYjJDHP+g/FVk2sKvK+iPxiDhLKV3
vvekIpX7436tJbuYqVmW
=2xDm
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists