[UNIX] DoS and Code Execution Issue in LedgerSMB
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 7 Mar 2007 12:53:27 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
DoS and Code Execution Issue in LedgerSMB
------------------------------------------------------------------------
SUMMARY
A person on the LedgerSMB core team has found a serious arbitrary code
execution issue in LedgerSMB prior to 1.1.5 and SQL-Ledger. A version of
SQL-Ledger which fixes this vulnerability was released today (version
2.6.25).
DETAILS
Vulnerable Systems:
* LedgerSMB versions prior to 1.1.5
Immune Systems:
* LedgerSMB version 1.1.5
The vulnerability allows a user to specify a custom function to run when
the software encounters an error. The software further assumes that the
error function specified never returns. For this reason, it is possible
to cause the software to take alternate paths of execution, and to force
these paths. This is particularly dangerous for users with valid logins.
For those which do not have valid login credentials, the problem more
limited but still quite dangerous. Using this method it is possible to
overwrite files in the users directory, thus affecting a DoS attack and
possible authentication bypass.
The DoS attacks can be done by any user not currently logged in, and can
force the writing of a nologin file (which will lock users out of the
system) or overwrite the users/members file (which contains users'
credentials info and settings) with invalid data. This attack can be done
with wget, for example.
All SQL-Ledger users are advised to upgrade to the latest version, and all
LedgerSMB users using versions prior to 1.1.5 should upgrade as well.
ADDITIONAL INFORMATION
The information has been provided by <mailto:chris@xxxxxxxxxxxxxxxx>
Chris Travers.
The original article can be found at: <http://www.ledgersmb.org/>
http://www.ledgersmb.org/
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] Apple QuickTime udta ATOM Integer Overflow
- Next by Date: [EXPL] Oracle 10g Local Privilege Elevation (PROCESS_DUP_HANDLE, WIN32)
- Previous by thread: [NEWS] Apple QuickTime udta ATOM Integer Overflow
- Next by thread: [EXPL] Oracle 10g Local Privilege Elevation (PROCESS_DUP_HANDLE, WIN32)
- Index(es):
Relevant Pages
- [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability
in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by
default. ... permissions and thus granted all local users the privilege to execute the
... (Securiteam) - [UNIX] SCO Multiple Local Buffer Overflow
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer
overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges.
... (Securiteam) - [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing
application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability
in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled
by ... (Securiteam) - [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have
been recently discovered in Tikiwiki, ... Remote exploitation of an input validation
vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on
the vulnerable ... (Securiteam) - [NT] Ipswitch Multiple Vulnerabilities (IMail IMAP LIST Command DoS, Collaboration Suite SMTP Format
... The following security advisory is sent to the securiteam mailing list, and can be
found at the SecuriTeam web site: http://www.securiteam.com ... Ipswitch Multiple Vulnerabilities
(IMail IMAP LIST Command DoS, ... Collaboration Suite SMTP Format String) ... Remote
exploitation of a denial of service vulnerability in Ipswitch ... (Securiteam)
