Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 17 May 2017 22:08:25 +0200
From: Stefan Pietsch <stefan.pietsch@...mole.com>
To: <oss-security@...ts.openwall.com>
CC: <fulldisclosure@...lists.org>
Subject: Re: Dolibarr ERP & CRM - Multiple Issues

On 10.05.2017 10:28, FOXMOLE Advisories wrote:
> === FOXMOLE - Security Advisory 2017-02-23 ===
> 
> Dolibarr ERP & CRM  - Multiple Issues
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> Affected Versions
> =================
> Dolibarr 4.0.4
> 
> Issue Overview
> ==============
> Vulnerability Type: SQL Injection, Cross Site Scripting,
>                     Weak Hash Algorithm without Salt, Weak Password Change Method
> Technical Risk: critical
> Likelihood of Exploitation: medium
> Vendor: Dolibarr
> Vendor URL: https://www.dolibarr.org/
> Credits: FOXMOLE employees Tim Herres and Stefan Pietsch
> Advisory URL: https://www.foxmole.com/advisories/foxmole-2017-02-23.txt
> Advisory Status: Public
> OVE-ID: OVE-20170223-0001
> CVE Number: CVE-2017-7886, CVE-2017-7887, CVE-2017-7888
> CVE URL: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7886
>          https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7887
>          https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7888
> CWE-ID: CWE-79, CWE-89, CWE-327, CWE-620, CWE-759
> CVSS 2.0: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

--- snip ---

Here is a small update to our security advisory.

An additional CVE ID got assigned for the password change finding:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8879


Meanwhile the Dolibarr developers fixed more possible SQL injection bugs
in this git commit:
https://github.com/Dolibarr/dolibarr/commit/fa290c34fad108ec7c0751c0372ae9c4b4f63b06

They still didn't release a fixed version of the Dolibarr software.



For CVE-2017-7886 I don't agree with the CVSS v2 scoring from the NIST.
They rated "Confidentiality Impact" as partial while I think it is
complete as we have full access to all tables.


Regards,
Stefan



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.