full-disclosure - [FD] Graylog2-Web LDAP Injection - CVE-2014-9217

Open Source and information security mailing list archives

Message-ID: <CAFCb7uimoqYU0hCXi0xPs80X+PptkGY9C05WH=qt-M0anScN+A@mail.gmail.com>
Date: Mon, 22 Dec 2014 07:35:30 -0900
From: "J. Tozo" <juniorbsd@...il.com>
To: fulldisclosure@...lists.org, bugtraq <bugtraq@...urityfocus.com>, 
	oss-security@...ts.openwall.com
Subject: [FD] Graylog2-Web LDAP Injection - CVE-2014-9217

=====[Alligator Security Team - Security Advisory]========
- Graylog2-Web LDAP Injection - CVE-2014-9217 - Author: José Tozo <
juniorbsd () gmail com > =====[Table of
Contents]================================== 1. Background 2. Detailed
description 3. Other contexts & solutions 4. Timeline 5. References
=====[1. Background]====================================== Graylog2 is a
free and open source system that allows you to centralize, analyze and
real-time process terabytes of log messages. =====[2. Detailed
description]============================ Graylog2-web is prone to a LDAP
Injection in its username field, which in special scenarios could lead an
attacker to inject commands in the backend. The vulnerability described in
this document can be validated using the following example:
A valid username and password required.
Given a username johndoe and a password superpass, you can sucessfull
achieve login by using:

username: *oe password: superpass
If the bind search returns one valid member, the login will be sucessfull.

=====[3. Other contexts & solutions]====================== In Graylog2-Web
v0.92, The Login screen has been improved so it is not vulnerable to this
kind of attack. To have the fix applied, you need to update your software
to at least the aforementioned version. But we encourage the users to use
the most recent version available in the vendor's website [1]. =====[4.
Timeline]======================================== 26/11/14 Vendor
notification. 01/12/14 Vendor rolled out a fix.[2] 02/12/14 Mitre assigned
CVE-2014-9217. 23/12/14 Disclosure date. =====[5.
Reference]=======================================
1 - https://www.graylog2.org 2 -
https://www.graylog2.org/news/post/0010-graylog2-v0-92

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives