cnvd - cnvd-2016-05093

cnvd-2016-05093

Vulnerability from cnvd

Title: Open-Xchange OX Guard安全绕过漏洞

Description:

Open-Xchange OX Guard是美国Open-Xchange公司的一套针对电子邮件和文件的安全防护软件。

Open-Xchange OX Guard 2.0和2.2.0版本中存在安全绕过漏洞，攻击者可利用该漏洞绕过安全限制，执行未授权操作。

Severity: 中

Patch Name: Open-Xchange OX Guard安全绕过漏洞的补丁

Patch Description:

Open-Xchange OX Guard是美国Open-Xchange公司的一套针对电子邮件和文件的安全防护软件。

Open-Xchange OX Guard 2.0和2.2.0版本中存在安全绕过漏洞，攻击者可利用该漏洞绕过安全限制，执行未授权操作。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://software.open-xchange.com/products/guard/doc/Release_Notes_for_OX_Guard_v2.2.1_2015-12-15.pdf

Reference: http://www.securityfocus.com/bid/84033

Impacted products

Name
['Open-Xchange OX Guard 2.0', 'Open-Xchange OX Guard 2.2.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "84033"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-8542"
    }
  },
  "description": "Open-Xchange OX Guard\u662f\u7f8e\u56fdOpen-Xchange\u516c\u53f8\u7684\u4e00\u5957\u9488\u5bf9\u7535\u5b50\u90ae\u4ef6\u548c\u6587\u4ef6\u7684\u5b89\u5168\u9632\u62a4\u8f6f\u4ef6\u3002\r\n\r\nOpen-Xchange OX Guard 2.0\u548c2.2.0\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002",
  "discovererName": "Open-Xchange",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://software.open-xchange.com/products/guard/doc/Release_Notes_for_OX_Guard_v2.2.1_2015-12-15.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-05093",
  "openTime": "2016-07-21",
  "patchDescription": "Open-Xchange OX Guard\u662f\u7f8e\u56fdOpen-Xchange\u516c\u53f8\u7684\u4e00\u5957\u9488\u5bf9\u7535\u5b50\u90ae\u4ef6\u548c\u6587\u4ef6\u7684\u5b89\u5168\u9632\u62a4\u8f6f\u4ef6\u3002\r\n\r\nOpen-Xchange OX Guard 2.0\u548c2.2.0\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u6267\u884c\u672a\u6388\u6743\u64cd\u4f5c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Open-Xchange OX Guard\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Open-Xchange OX Guard 2.0",
      "Open-Xchange OX Guard 2.2.0"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/84033",
  "serverity": "\u4e2d",
  "submitTime": "2016-07-19",
  "title": "Open-Xchange OX Guard\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2015-8542 (GCVE-0-2015-8542)

Vulnerability from cvelistv5

Published

2016-12-15 06:31

Modified

2024-08-06 08:20

Severity ?

CWE

Summary

An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader.

References

▼	URL	Tags
	http://www.securityfocus.com/archive/1/537678/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.securitytracker.com/id/1035174	vdb-entry, x_refsource_SECTRACK
	http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T08:20:43.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20160302 Open-Xchange Security Advisory 2016-03-02",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/537678/100/0/threaded"
          },
          {
            "name": "1035174",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035174"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-12-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The \"getprivkeybyid\" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the \"id\" and \"cid\" parameter to specify the current user by its user- and context-ID. The \"auth\" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user\u0027s PGP Private Key by iterating the \"id\" and \"cid\" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the \"id\" and \"cid\" parameters are sequential they are much easier to predict than a user\u0027s login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and \"guests\" which use the external mail reader."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20160302 Open-Xchange Security Advisory 2016-03-02",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/537678/100/0/threaded"
        },
        {
          "name": "1035174",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035174"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-8542",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The \"getprivkeybyid\" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the \"id\" and \"cid\" parameter to specify the current user by its user- and context-ID. The \"auth\" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user\u0027s PGP Private Key by iterating the \"id\" and \"cid\" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the \"id\" and \"cid\" parameters are sequential they are much easier to predict than a user\u0027s login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and \"guests\" which use the external mail reader."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20160302 Open-Xchange Security Advisory 2016-03-02",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/537678/100/0/threaded"
            },
            {
              "name": "1035174",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035174"
            },
            {
              "name": "http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.html",
              "refsource": "CONFIRM",
              "url": "http://packetstormsecurity.com/files/136069/Open-Xchange-Guard-2.2.0-2.0-Private-Key-Disclosure.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-8542",
    "datePublished": "2016-12-15T06:31:00",
    "dateReserved": "2015-12-11T00:00:00",
    "dateUpdated": "2024-08-06T08:20:43.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted