lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAFCb7uimoqYU0hCXi0xPs80X+PptkGY9C05WH=qt-M0anScN+A@mail.gmail.com> Date: Mon, 22 Dec 2014 07:35:30 -0900 From: "J. Tozo" <juniorbsd@...il.com> To: fulldisclosure@...lists.org, bugtraq <bugtraq@...urityfocus.com>, oss-security@...ts.openwall.com Subject: [FD] Graylog2-Web LDAP Injection - CVE-2014-9217 =====[Alligator Security Team - Security Advisory]======== - Graylog2-Web LDAP Injection - CVE-2014-9217 - Author: José Tozo < juniorbsd () gmail com > =====[Table of Contents]================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4. Timeline 5. References =====[1. Background]====================================== Graylog2 is a free and open source system that allows you to centralize, analyze and real-time process terabytes of log messages. =====[2. Detailed description]============================ Graylog2-web is prone to a LDAP Injection in its username field, which in special scenarios could lead an attacker to inject commands in the backend. The vulnerability described in this document can be validated using the following example: A valid username and password required. Given a username johndoe and a password superpass, you can sucessfull achieve login by using: username: *oe password: superpass If the bind search returns one valid member, the login will be sucessfull. =====[3. Other contexts & solutions]====================== In Graylog2-Web v0.92, The Login screen has been improved so it is not vulnerable to this kind of attack. To have the fix applied, you need to update your software to at least the aforementioned version. But we encourage the users to use the most recent version available in the vendor's website [1]. =====[4. Timeline]======================================== 26/11/14 Vendor notification. 01/12/14 Vendor rolled out a fix.[2] 02/12/14 Mitre assigned CVE-2014-9217. 23/12/14 Disclosure date. =====[5. Reference]======================================= 1 - https://www.graylog2.org 2 - https://www.graylog2.org/news/post/0010-graylog2-v0-92 _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists