Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 02 Mar 2016 13:12:31 +0000
From: Darren Martyn <darren.martyn@...hosresearch.co.uk>
To: oss-security@...ts.openwall.com
Subject: CVE Request(s): VTigerCRM and SugarCRM

Hi List,
Requesting CVE's to be issued as appropriate for the following security
issues.

SugarCRM Incomplete Blacklist leading to shell upload.
This is the exact same issue as CVE-2015-5946, except different product
(CVE-2015-5946 was issued for SuiteCRM, which is a SugarCRM fork).
Unsure if this needs a second CVE issued or not given it is a different
product (same original codebase though).
The version tested was SugarCRM Community Edition version 6.5.22.

VTiger CRM Post-Auth Shell Upload.
Version Tested: vtiger CRM 4.2 Patch 2
This is a similar issue to the original SugarCRM and SuiteCRM issues.
Effectively, the filtering applied to prevent uploading executable files
is insufficient and trivially bypassed, leading to remote code execution.
The checks avoided are a horrible "check if there is PHP in the file"
function, getimagesize(), a MIME type check, and a file extension check.
Given that it is a different code-path entirely to the original SugarCRM
codebase, it probably should be treated as a different issue.

Details are outlined here, to avoid repeating the same information:
http://xiphosresearch.com/2016/03/01/Vulnerability-Inheritance-across-Forks.html

Both issues (SugarCRM and VTigerCRM) require authentication, however
both clearly display bypass of intended security restrictions.

Best regards,
Darren Martyn.



[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ