[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201402191541.s1JFfQur016389@linus.mitre.org>
Date: Wed, 19 Feb 2014 10:41:26 -0500 (EST)
From: cve-assign@...re.org
To: pedrib@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, rb@...lite.de
Subject: Re: CVE request: remote code execution in egroupware <= 1.8.005
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> I have discovered a remote code execution via php unserialize in egroupware
> <= 1.8.005.
Use CVE-2014-2027.
> https://github.com/pedrib/PoC/raw/master/egroupware-1.8.005.txt
> http://www.egroupware.org/changelog
> Security: fixed arbitrary file overwrite and remote code execution
> reported by Pedro Ribeiro (pedrib@...il.com) of Agile Information
> Security
We could not immediately determine whether the egroupware-1.8.005.txt
disclosure means that:
Arbitrary file overwrite in __destruct:
Remote code execution in __destruct:
are both exploitable only as a consequence of unsafe unserialize use.
If eliminating the unsafe unserialize use would not completely address
those issues, additional CVE IDs may be needed.
There are no new CVE assignments yet for possible other issues in the
1.8.006.20140217 changelog entry, such as:
CalDAV/Calendar: fixed permanent auth request in iCal, if
accountselection is set to "selectbox with groupmembers" and rights
granted from group without being a member
SiteMgr: fixed not working anonymous user and using now a random
password
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTBM46AAoJEKllVAevmvmsxAMIAJkEBcmLzIHLG9wYtP1kGKhL
kl6SYyRmSiXW0YVgOJsua6WcdDHcnhIGyg/pMKRNBf2367ox2M6mp6s2x3zPqULF
TLZZps7IdT/armUe9jf5OBzDLhj6yE9bPCp+MTJ0YAN1T6jVGWKU5rd8HDDuR9CR
1yAjrTJi3JpkqggZSwzsO0lJg4Me7d+7YnsvEYAp59tRE02hCzT+3vfWBOEm//VL
h0tWpFBgPchm51QslLNAKAWFzjjggu6BBfmdfJCHp12Y1Cp62zjPHYL4PYjkYSb1
95AOGPd8a7zTyrUhexTMz8tVCs1TK1ZVyWOKRx99UpS/wNxJeBwidMd4KVOM/A8=
=usF1
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
