Date: Mon, 22 Dec 2014 07:35:30 -0900 From: "J. Tozo" <juniorbsd@...il.com> To: fulldisclosure@...lists.org, bugtraq <bugtraq@...urityfocus.com>, oss-security@...ts.openwall.com Subject: Graylog2-Web LDAP Injection - CVE-2014-9217 =====[Alligator Security Team - Security Advisory]======== - Graylog2-Web LDAP Injection - CVE-2014-9217 - Author: José Tozo < juniorbsd () gmail com > =====[Table of Contents]================================== 1. Background 2. Detailed description 3. Other contexts & solutions 4. Timeline 5. References =====[1. Background]====================================== Graylog2 is a free and open source system that allows you to centralize, analyze and real-time process terabytes of log messages. =====[2. Detailed description]============================ Graylog2-web is prone to a LDAP Injection in its username field, which in special scenarios could lead an attacker to inject commands in the backend. The vulnerability described in this document can be validated using the following example: A valid username and password required. Given a username johndoe and a password superpass, you can sucessfull achieve login by using: username: *oe password: superpass If the bind search returns one valid member, the login will be sucessfull. =====[3. Other contexts & solutions]====================== In Graylog2-Web v0.92, The Login screen has been improved so it is not vulnerable to this kind of attack. To have the fix applied, you need to update your software to at least the aforementioned version. But we encourage the users to use the most recent version available in the vendor's website . =====[4. Timeline]======================================== 26/11/14 Vendor notification. 01/12/14 Vendor rolled out a fix. 02/12/14 Mitre assigned CVE-2014-9217. 23/12/14 Disclosure date. =====[5. Reference]======================================= 1 - https://www.graylog2.org 2 - https://www.graylog2.org/news/post/0010-graylog2-v0-92
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.