Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 19 Feb 2014 10:41:26 -0500 (EST)
From: cve-assign@...re.org
To: pedrib@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, rb@...lite.de
Subject: Re: CVE request: remote code execution in egroupware <= 1.8.005

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> I have discovered a remote code execution via php unserialize in egroupware
> <= 1.8.005.

Use CVE-2014-2027.

> https://github.com/pedrib/PoC/raw/master/egroupware-1.8.005.txt
> http://www.egroupware.org/changelog

> Security: fixed arbitrary file overwrite and remote code execution
> reported by Pedro Ribeiro (pedrib@...il.com) of Agile Information
> Security

We could not immediately determine whether the egroupware-1.8.005.txt
disclosure means that:

  Arbitrary file overwrite in __destruct:

  Remote code execution in __destruct:

are both exploitable only as a consequence of unsafe unserialize use.
If eliminating the unsafe unserialize use would not completely address
those issues, additional CVE IDs may be needed.

There are no new CVE assignments yet for possible other issues in the
1.8.006.20140217 changelog entry, such as:

  CalDAV/Calendar: fixed permanent auth request in iCal, if
  accountselection is set to "selectbox with groupmembers" and rights
  granted from group without being a member

  SiteMgr: fixed not working anonymous user and using now a random
  password

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTBM46AAoJEKllVAevmvmsxAMIAJkEBcmLzIHLG9wYtP1kGKhL
kl6SYyRmSiXW0YVgOJsua6WcdDHcnhIGyg/pMKRNBf2367ox2M6mp6s2x3zPqULF
TLZZps7IdT/armUe9jf5OBzDLhj6yE9bPCp+MTJ0YAN1T6jVGWKU5rd8HDDuR9CR
1yAjrTJi3JpkqggZSwzsO0lJg4Me7d+7YnsvEYAp59tRE02hCzT+3vfWBOEm//VL
h0tWpFBgPchm51QslLNAKAWFzjjggu6BBfmdfJCHp12Y1Cp62zjPHYL4PYjkYSb1
95AOGPd8a7zTyrUhexTMz8tVCs1TK1ZVyWOKRx99UpS/wNxJeBwidMd4KVOM/A8=
=usF1
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ