oss-security - plone, rrdtool, zenoss bugs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAN00zFDemB78NwGXC1qTU9hCpW9Cv4MVtM7dCJ5KfCoxA3eMfA@mail.gmail.com>
Date: Thu, 18 Apr 2013 14:05:42 +0200
From: Thomas Pollet <thomas.pollet@...il.com>
To: oss-security@...ts.openwall.com
Subject: plone, rrdtool, zenoss bugs

Hi,

I reported a csrf bug in plone pluggable authentication service, fixed in
4.2.5
http://plone.org/products/plone/releases/4.2.5
" CSRF protection for the ZODBUserManager, ZODBGroupManager,
ZODBRoleManger, and DynamicGroupsPlugin plugins."


Also,
the rrdtool python module crashes on format string exploit
$ python -c "import rrdtool
rrdtool.graph('/tmp/out.png','-f','%n%n')"
Segmentation fault

this module is used by zenoss to create graphs (zenoss users are able to
pass arguments to rrdtool).

On zenoss, I reported some bugs to them (and to this list) which have been
fixed in the latest release (4.2.3). for example, zenoss displayed syslog
and snmp input without filtering html characters which results in xss.

example syslog exploit :
echo '<130>' Aug 29 07:17:34 test '<xss>' | nc -u zenoss 514

another bug was that the test_datasource feature doesn't escape the snmp
oid which is passed by zenoss to the shell as an argument for the snmpwalk
command
example: https://
[ZENOSS_HOST]/zport/dmd/Devices/rrdTemplates/Device/datasources/sysUpTime/test_datasource?data={%22newId%22:%22DetectedVirus%22,%22oid%22:%22$%28ls%20%3E%20/tmp/pwn%29%22,%22enabled%22:%22on%22,%22testDevice%22:%22127.0.0.1%22,%22uid%22:%22%22}

http://jira.zenoss.com/jira/browse/ZEN-3183


Cheers,
T

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.