[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 9 Jul 2016 11:27:33 -0400 (EDT)
From: cve-assign@...re.org
To: jens.erat@...-konstanz.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: several SOGo issues (DOS, XSS, information leakage)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
> SOGo #3510: DOS attack through uploading malicious attachments
> Fix: http://github.com/inverse-inc/sogo/commit/32bb1456e23a32c7f45079c3985bf732dd0d276d
> Issue: https://sogo.nu/bugs/view.php?id=3510
>> 1. Create a large file, for example `dd if=/dev/zero of=/tmp/1GB bs=1M count=1000`
>> 2. Open new mail in SOGo, try to attach large file
>> 3. If attachment fails, some memory gets freed, but not all of it
>> 4. Repeat 1-3 until server crashes
> The issues was resolved by limiting the upload size ...
>
> Further investigation showed that not memcached was the issue but
> temporary files kept around
Use CVE-2016-6188.
> SOGo #3695: Private information leakage through ics/XML feeds when restricted to "View the Date & Time"
> Fix SOGo v2: https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225
> Fix SOGo v3: https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
> Issue: https://sogo.nu/bugs/view.php?id=3695
> 1. Not all private information removed for the public free/busy view
>> I was able to observe following fields containing critical information:
>>
>> - ORGANIZER (who invited the calendar owner?)
>> - X-ALT-DESC (Outlook-specific extended copy of the description?)
Use CVE-2016-6189.
> SOGo #3696: Meta information can be derived from UID/DTSTAMP attributes though
> "View the Date & Time" restricted access Backend Calendar
> Fix SOGo v2: https://github.com/inverse-inc/sogo/commit/717f45f640a2866b76a8984139391fae64339225
> Fix SOGo v3: https://github.com/inverse-inc/sogo/commit/875a4aca3218340fd4d3141950c82c2ff45b343d
> Issue: https://sogo.nu/bugs/view.php?id=3696
> 2. It was possible to join appointments based on the UID of the
> public free/busy view from different users, to know who has
> appointments with whom
>> one can derive common appointments between other people
Use CVE-2016-6190.
> SOGo #3718: Persistent Cross-Site Scripting in calendar
> Issue: https://sogo.nu/bugs/view.php?id=3718
> Fix: http://github.com/inverse-inc/sogo/commit/64ce3c9c22fd9a28caabf11e76216cd53d0245aa
>> When creating a calendar entry containing script code
Use CVE-2016-6191.
> SOGo #2598: Script injection in calendar title
> Fixes: - https://github.com/inverse-inc/sogo/commit/1a7fc2a0e90a19dfb1fce292ae5ff53aa513ade9
> - https://github.com/inverse-inc/sogo/commit/80a09407652ec04e8c9fb6cb48e1029e69a15765
> - https://github.com/inverse-inc/sogo/commit/3a5e44e7eb8b390b67a8f8a83030b49606956501
> - https://github.com/inverse-inc/sogo/commit/c94595ea7f0f843c2d7abf25df039b2bbe707625
> Issue: https://sogo.nu/bugs/view.php?id=2598
>
> The (now public) issue log says I realized the issue also exists with contacts
>> Add injection code, for example in the "Display" name field
Use CVE-2014-9905 for the XSS issues in both the calendar title and
the contacts module.
We cannot yet send a CVE ID here for the non-public issue #3670.
- --
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJXgRd2AAoJEHb/MwWLVhi2A5wP/j6sHW/jtA04EIw4E0KiQRFt
wI9QOZ1BdyptWssGcq0r5FV8p1sdVsjiFn607Dj8uVXjf1Txpai7/Z7Dpl3Ssejh
LXdABo+TDnCM49n0CKyQUzSF+HfaUoU2HRar+48pB1KqYx+hahE4TVZ+14L9etvg
UMJzkeu/cEzS8vh6G9VFp0vEOAhWuhcfKqBVrMjU2hFSCHLJVrvduO05uvMlJ0fJ
B5nLcAR6OCiFcqZ+ttHtxOCSZD96bpogBAkxCMsl7rz6iZpwqMdhJrh+8wf5cIfn
T2v+5fPRiM0/rm0NCjI8bWd87pI7ZWr+FNbuqwkPeGwHtYpwrMryfMaiMmqdSf+V
rxaKOsYwh5vr6IddVBQAQF+OmVBj71wfsydl71HvZdp4vLCZcr8EgpaQPFjltC//
2EEsQ7dsfJIGY9GfarYPVuwLN2psqiUkf1x1KvEPzcSFJn+w0LLx2qxeGwFc3X0m
11MYp+v0C1LVmYwaf+vNrnMf537sN+K8s6pN80Hf+t7lB3hEmilyeaPoXWxOyF8s
t3hAJ6isrhTZ10xqX6nFz1I69piNp4IEJQ7SgbXJoI8BJEDucYC99G/VBaB2j3WA
JdXI5I1fZZ/rTPT3EcBrM8psMWJmOGNUBnZmJfFpalIfkrD9OqKkvtovNm+EF/we
XHadO9HsP5kU7/eTgBEf
=Uq/q
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
