Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 444163 - <www-apps/owncloud-4.5.2-r1: DoS on uploading any file using a postgresql backend
Summary: <www-apps/owncloud-4.5.2-r1: DoS on uploading any file using a postgresql bac...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://github.com/owncloud/core/issu...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2012-11-21 14:14 UTC by Thomas Beutin
Modified: 2012-11-26 12:25 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Beutin 2012-11-21 14:14:37 UTC
the bug is upstream well known:
https://github.com/owncloud/core/issues/513

i don't know if its related to postgresql only, but this patch works for me:
https://github.com/eMerzh/core/commit/bfff3d3f9baf5baaf9ea247d0a5d17ac498f8077

Reproducible: Always

Steps to Reproduce:
1. install www-apps/owncloud-4.5.2
2. try to create a folder using a webdav-client
3. or try to login on the web-interface
Actual Results:  
In a webdav-client the creation of the folder simply fails.
In a browser you'll get a HTTP Error 500 (Internal Server Error) when You try to login.

Expected Results:  
Working like the previous version (4.5.1).

emerge --info
Portage 2.1.11.31 (default/linux/amd64/10.0, gcc-4.5.4, glibc-2.15-r3, 3.5.7-gentoo x86_64)
=================================================================
System uname: Linux-3.5.7-gentoo-x86_64-Intel-R-_Xeon-R-_CPU_E31220_@_3.10GHz-with-gentoo-2.1
Timestamp of tree: Wed, 21 Nov 2012 12:30:01 +0000
ld GNU ld (GNU Binutils) 2.22
app-shells/bash:          4.2_p37
dev-lang/python:          2.7.3-r2, 3.2.3
dev-util/cmake:           2.8.9
dev-util/pkgconfig:       0.27.1
sys-apps/baselayout:      2.1-r1
sys-apps/openrc:          0.11.5
sys-apps/sandbox:         2.5
sys-devel/autoconf:       2.13, 2.68
sys-devel/automake:       1.11.6
sys-devel/binutils:       2.22-r1
sys-devel/gcc:            4.5.4
sys-devel/gcc-config:     1.7.3
sys-devel/libtool:        2.4-r1
sys-devel/make:           3.82-r3
sys-kernel/linux-headers: 3.6 (virtual/os-headers)
sys-libs/glibc:           2.15-r3
Repositories: gentoo sunrise science
ACCEPT_KEYWORDS="amd64"
ACCEPT_LICENSE="* -@EULA @FREE Intel-SDP"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=core2 -fomit-frame-pointer -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/openvpn/easy-rsa /var/bind"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.3/ext-active/ /etc/php/apache2-php5.4/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cgi-php5.4/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/php/cli-php5.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=core2 -fomit-frame-pointer -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en"
MAKEOPTS="-j5"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/var/lib/layman/sunrise /var/lib/layman/science"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X509 aac aacplus aalib accounting acl adns aim amd64 ansi apache2 automount bacula-console bash-completion bcmath berkdb bidi bind-mysql bittorrent bzip2 calendar caps ccache cdb cgi chipcard chroot command-args cpudetection cpulimit cracklib cramfs crypt cscope css csv ctype curl curlwrappers customlog cvsgraph cxx cyrus dba dbi dbm dbx devmap dhcp dlopen dnsdb ecc encode enscript exif expat fam fastcgi ffmpeg flac flash flatfile fpx ftp gd gdal gdbm geoip geos gif gmp graphviz gs gssapi gzip hardened hardenedphp hdf5 hpn http i18n iconv icq idea idled idn imagemagick imap imlib imlib2 inifile innodb ipalias ipv6 jabber jbig jpeg jpeg2k lcms ldap less libwww lm_sensors lmtp logrotate logwatch lzma lzo mbox mcal memlimit mgetty mhash milter mime mimencode ming mmap mmx mp3 mpeg mpm-prefork mppe-mppc multilib mysql mysqli nagios-dns nagios-game nagios-ntp nagios-ping nagios-ssh ncurses netboot netcdf network nfs nis nls nntp nptl nptlonly oav odbc ogg oggvorbis openmp openssh openssl pam pam_chroot pam_timestamp parse-clocks pcntl pcre pdf pdfkit pdflib perl php pic png posix postfix postgis postgres procmail pwdb python qdbm quotas radius readline recode reiserfs rrdtool rss sample sasl screen sendfile sensord session sftp sftplogging shaper shared sharedext sieve simplexml slang slp smartcard smime smp sms smtp snmp snortsam soap sockets socks5 spamassassin spell spl sql sqlite sqlite3 sse sse2 sse4 sse4_1 ssl ssse3 stream subversion svg sysfs syslog sysvipc szip tcpd theora tidy tiff tls tokenizer transparent-proxy truetype truetype-fonts type1-fonts unicode userlocales utf8 uuid vhosts vim-syntax virtual-users virus-scan vorbis vpx wddx withsamplescripts wmf x264 xattr xfs xinetd xml xml2 xmlrpc xpm xsl xslt xvid yahoo yaz zlib" APACHE2_MODULES="access auth auth_basic authn_dbm dbd ident imagemap authn_dbd authn_file authn_default authz_groupfile authn_alias authn_anon authz_dbm authz_owner authz_default authz_user auth_digest authz_host alias file_cache echo charset_lite cache disk_cache mem_cache ext_filter case_filter case-filter-in deflate filter mime_magic cern_meta proxy_ajp proxy_balancer expires headers usertrack proxy proxy_connect proxy_ftp proxy_http info include cgi cgid dav dav_lock dav_fs vhost_alias speling rewrite log_config logio env setenvif mime status substitute autoindex asis negotiation dir imap actions userdir so unique_id" APACHE2_MPMS="prefork" CURL_SSL="openssl" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LINGUAS="en" PHP_TARGETS="php5-3 php5-4" PYTHON_TARGETS="python2_7 python3_2" QEMU_SOFTMMU_TARGETS="i386 x86_64" QEMU_USER_TARGETS="i386 x86_64" USERLAND="GNU" VIDEO_CARDS="vga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON
Comment 1 Sean Amoss (RETIRED) gentoo-dev Security 2012-11-21 20:46:30 UTC
Thanks for the report, Thomas.
Comment 2 Bernard Cafarelli gentoo-dev 2012-11-22 16:04:41 UTC
Thanks for the report and upstream links! I added the patch to 4.5.2-1 (and removed 4.5.2).
Comment 3 Sean Amoss (RETIRED) gentoo-dev Security 2012-11-26 12:25:19 UTC
Thanks, Bernard.

Closing noglsa for ~arch only.