ID CVE-2017-8342
Summary Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
References
Vulnerable Configurations
  • Radicale 2.0.0 Release Candidate 1
    cpe:2.3:a:radicale:radicale:2.0.0:rc1
  • Radicale 1.1.1
    cpe:2.3:a:radicale:radicale:1.1.1
CVSS
Base: 4.3 (as of 10-05-2017 - 15:08)
Impact:
Exploitability:
CWE CWE-362
CAPEC
  • Leveraging Race Conditions
    This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
  • Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
    This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. The typical example is the file access. The attacker can leverage a file access race condition by "running the race", meaning that he would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the attacker could do something such as replace the file and cause an escalation of privilege.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-CDC7CAED36.NASL
    description Security fix for CVE-2017-8342 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-02-02
    plugin id 100199
    published 2017-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100199
    title Fedora 24 : radicale (2017-cdc7caed36)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-2AB5BAEA0A.NASL
    description Security fix for CVE-2017-8342 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-02-01
    plugin id 100185
    published 2017-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100185
    title Fedora 25 : radicale (2017-2ab5baea0a)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2017-863F86E7A9.NASL
    description Security fix for CVE-2017-8342 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-02-02
    plugin id 101675
    published 2017-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=101675
    title Fedora 26 : radicale (2017-863f86e7a9)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-934.NASL
    description Radicale before 1.1.2 and 2.x before 2.0.0rc2 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method. For Debian 7 'Wheezy', these problems have been fixed in version 0.7-1.1+deb7u2. We recommend that you upgrade your radicale packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-10
    plugin id 100069
    published 2017-05-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=100069
    title Debian DLA-934-1 : radicale security update
refmap via4
confirm
Last major update 11-05-2017 - 12:40
Published 30-04-2017 - 11:59
Last modified 11-05-2017 - 12:40
Back to Top