Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 254309 (CVE-2009-0496) - net-im/openfire <3.6.3 XSS leading to arbitrary code execution and information disclosure (CVE-2009-{0496,0497})
Summary: net-im/openfire <3.6.3 XSS leading to arbitrary code execution and informatio...
Status: RESOLVED FIXED
Alias: CVE-2009-0496
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://www.coresecurity.com/content/o...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-01-09 13:26 UTC by Stefan Behte (RETIRED)
Modified: 2009-04-02 21:01 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2009-01-09 13:26:07 UTC 
From the advisory:

Openfire is a real time collaboration (RTC) server licensed under the Open Source GPL. It uses the widely adopted open protocol for instant messaging XMPP, also called Jabber. Multiple cross-site scripting vulnerabilities have been found, which may lead to arbitrary remote code execution on the server running the application due to unauthorized upload of Java plugin code.
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2009-01-09 14:42:50 UTC 
It's still XSS based.
Comment 2 Stefan Behte (RETIRED) gentoo-dev Security 2009-01-09 15:26:49 UTC 
But "Remote passive compromise: remote execution of arbitrary code by enticing a user to visit a malicious server or using malicious data" fits. ;P
Comment 3 Robert Buchholz (RETIRED) gentoo-dev 2009-01-13 12:42:51 UTC 
+*openfire-3.6.3 (13 Jan 2009)
+
+  13 Jan 2009; Robert Buchholz <rbu@gentoo.org> -openfire-3.5.2.ebuild,
+  -openfire-3.6.0.ebuild, -openfire-3.6.0a.ebuild, +openfire-3.6.3.ebuild:
+  Proxy commit for jokey: Version bump (bug #248857) for security bug (#254309)
+  fixing a Cross-Site Scripting vulnerability that can be exploited to execute
+  arbitrary code on the server.

I'll add arches later tonight.
Comment 4 Robert Buchholz (RETIRED) gentoo-dev 2009-01-15 12:07:21 UTC 
Arches, please test and mark stable:
=net-im/openfire-3.6.3
Target keywords : "amd64 x86"
Comment 5 Markus Meier gentoo-dev 2009-01-15 22:02:26 UTC 
amd64/x86 stable, all arches done.
Comment 6 Tobias Heinlein (RETIRED) gentoo-dev 2009-01-28 00:31:33 UTC 
Ready for vote, I vote YES.
Comment 7 Markus Ullmann (RETIRED) gentoo-dev 2009-01-31 21:47:10 UTC 
maybe send one glsa together with bug 246008 ?
Comment 8 Stefan Behte (RETIRED) gentoo-dev Security 2009-02-11 13:07:05 UTC 
CVE-2009-0496 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0496):
  Multiple cross-site scripting (XSS) vulnerabilities in Ignite
  Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary
  web script or HTML via the (1) log parameter to (a) logviewer.jsp and
  (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3)
  username parameter to (d) user-properties.jsp; (4) logDir, (5)
  maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout
  parameters to (e) audit-policy.jsp; (9) propName parameter to (f)
  server-properties.jsp; and the (10) roomconfig_roomname and (11)
  roomconfig_roomdesc parameters to (g) muc-room-edit-form.jsp.  NOTE:
  this can be leveraged for arbitrary code execution by using XSS to
  upload a malicious plugin.

CVE-2009-0497 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0497):
  Directory traversal vulnerability in log.jsp in Ignite Realtime
  Openfire 3.6.2 allows remote attackers to read arbitrary files via a
  ..\ (dot dot backslash) in the log parameter.
Comment 9 Robert Buchholz (RETIRED) gentoo-dev 2009-02-12 19:23:29 UTC 
YES too, request filed
Comment 10 Pierre-Yves Rofes (RETIRED) gentoo-dev 2009-04-02 21:01:22 UTC 
GLSA 200904-01