From a1f9673a7cd94805f1ed5ee3c046b37eb9d00535 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Thu, 25 Jun 2015 14:58:40 +0200 Subject: [PATCH] Add identifiers --- advisories/oc-sa-2015-005.php | 2 +- advisories/oc-sa-2015-006.php | 2 +- advisories/oc-sa-2015-007.php | 2 +- advisories/oc-sa-2015-008.php | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/advisories/oc-sa-2015-005.php b/advisories/oc-sa-2015-005.php index 578e1fd5a..38dc5a2a0 100644 --- a/advisories/oc-sa-2015-005.php +++ b/advisories/oc-sa-2015-005.php @@ -18,7 +18,7 @@

A bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted.

This was caused by a feature of PHP (which has been turned off per default as of PHP 5.6.0) in the handling of POST values sent to the remote host. If a value was prefixed with @ the content of the value was replaced with the file name specified after the @.

Effectively this might allow "dropbox.com" to read any files on the server if the following requirements are met:

Per default ownCloud does not include any Dropbox mounts.

Affected Software

Action Taken

The ownCloud server component is now refusing to handle any files containing a @ on the Dropbox external storage. This is no regression as handling files containing said character was not reliably possible before as well.

The upcoming ownCloud Server 8.1 will contain a new version of the used library to connect to Dropbox which handles files with @ correctly.

diff --git a/advisories/oc-sa-2015-006.php b/advisories/oc-sa-2015-006.php index d027e476b..5d7f886f4 100644 --- a/advisories/oc-sa-2015-006.php +++ b/advisories/oc-sa-2015-006.php @@ -18,7 +18,7 @@

Due to an improper control of the filename for a require_once() statement in the routing component a limited local file inclusion vulnerability is existent in all below mentioned ownCloud versions when running on the MS Windows Platform.

Depending on the ownCloud configuration and the authentication state of a remote attacker this vulnerability may have different impact. Specifically:

Affected Software

Action Taken

The ownCloud Server component is now properly sanitizing characters to the affected routing component. Starting with ownCloud 8.1 it will not be possible anymore to run ownCloud Server on the MS Windows Platform.

diff --git a/advisories/oc-sa-2015-007.php b/advisories/oc-sa-2015-007.php index 92b6b62ff..45857db0d 100644 --- a/advisories/oc-sa-2015-007.php +++ b/advisories/oc-sa-2015-007.php @@ -18,7 +18,7 @@

The sanitization component for filenames was vulnerable to DoS when parsing specially crafted file names passed via specific endpoints.

Effectively this lead to a endless loop filling the log file until the system is not anymore responsive.

Affected Software

Action Taken

This was caused by the PHP behaviour of allowing to cast $_GET values to an array. The critical usages have been fixed in all affected versions and with ownCloud 8.1 the usages of $_GET in the whole code base has been reviewed.

diff --git a/advisories/oc-sa-2015-008.php b/advisories/oc-sa-2015-008.php index cfca9a883..4956ee6c1 100644 --- a/advisories/oc-sa-2015-008.php +++ b/advisories/oc-sa-2015-008.php @@ -18,7 +18,7 @@

The external SMB storage of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands.

This was caused by improperly sanitizing the ; character which is interpreted as command separator by smbclient (the used software to connect to SMB shared by ownCloud)

Effectively this allows an attacker to gain access to any file on the system or overwrite it, finally leading to a PHP code execution in the case of ownCloud’s config file.

Affected Software

Action Taken

Files containing a ; are no longer processed on external SMB storages. This is no regression as handling files containing said character was not reliably possible before as well.

ownCloud 8.1 will feature a completely rewritten SMB storage with cleaner code to reduce the attack surface even more.