SEC Consult SA-20180424-0 :: Reflected Cross-Site Scripting in multiple Zyxel ZyWALL products
SEC Consult Vulnerability Lab Security Advisory < 20180424-0 > === title: Reflected Cross-Site Scripting product: Zyxel ZyWALL: see "Vulnerable / tested version" vulnerable version: ZLD 4.30 and before fixed version: ZLD 4.31 CVE number: - impact: Medium homepage: https://www.zyxel.com found: 2018-02-05 by: T. Weber (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com === Vendor description: --- "Focused on innovation and customer-centricity, Zyxel Communications Corp. has been connecting people to the internet for nearly 30 years. We keep promoting creativity which meets the needs of customers. This spirit has never been changed since we developed the world's first integrated 3-in-1 data/fax/voice modem in 1992. Our ability to adapt and innovate with networking technology places us at the forefront of understanding connectivity for telco/service providers, businesses and home users. We're building the networks of tomorrow, helping unlock the world's potential and meeting the needs of the modern workplace; powering people at work, life and play. We stand side-by-side with our customers and partners to share new approaches to networking that will unleash their abilities. Loyal friend, powerful ally, reliable resource — we are Zyxel, Your Networking Ally." Source: https://www.zyxel.com/about_zyxel/company_overview.shtml Business recommendation: SEC Consult recommends Zyxel customers to upgrade the firmware to the latest version available. A thorough security review should be performed by security professionals to identify further potential security issues. Vulnerability overview/description: --- 1) Reflected Cross-Site Scripting (XSS) A reflected cross-site scripting vulnerability was identified in 'free_time_failed.cgi' in the admin interface. The parameter 'err_msg' is returned without any sanitization of the input. An attacker, for example, can exploit this vulnerability to steal cookies from the attacked user in order to hijack a session and gain access to the device. Proof of concept: - 1) Reflected Cross-Site Scripting (XSS) By opening the following link, contents of the 'arip' and 'zy_pc_browser' cookies will be displayed. http:///free_time_failed.cgi?err_msg=alert(document.cookie); https:///free_time_failed.cgi?err_msg=alert(document.cookie); Vulnerable / tested versions: - The following versions are affected: Zyxel ZyWall USG 110 ZLD 4.30 and earlier Zyxel ZyWall USG 210 ZLD 4.30 and earlier Zyxel ZyWall USG 310 ZLD 4.30 and earlier Zyxel ZyWall USG 1100 ZLD 4.30 and earlier Zyxel ZyWall USG 1900 ZLD 4.30 and earlier Zyxel ZyWall USG 2200-VPN ZLD 4.30 and earlier Vendor contact timeline: 2018-02-07: Contacting vendor through secur...@zyxel.com.tw 2018-02-08: Vendor responded with contact information and a PGP key. Sent the encrypted advisory to the contact. 2018-02-09: Contact confirmed that the advisory was received. 2018-02-16: Contact confirmed the vulnerability and stated that the ZyWALL series is vulnerable to the reported vulnerability. The contact also stated that the vulnerability will be fixed until the end of March. Requested more information regarding version numbers and other affected devices. 2018-02-23: Contact confirmed that the devices are vulnerable in firmware version 4.30 and before. 2018-03-21: Contact informed us that the new firmware version will be ZLD 4.31 and that it will be released on 2018-04-17. Shifted release of advisory to 2018-04-17. 2018-04-12: Informed the contact that the advisory will be released in few days. 2018-04-17: Asked the vendor if ZLD 4.31 was released. Didn't find the new version on the customer portal. E-mail was blocked and returned. 2018-04-18: Found the new version (ZLD 4.31) on the customer portal. 2018-04-24: Advisory release. Solution: - Install firmware version ZLD 4.31 from the vendor's website to fix this issue: https://www.zyxel.com/support/download_landing.shtml Workaround: --- Restrict network access to the device. Advisory URL: - https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~ SEC Consult Vulnerability Lab SEC Consult Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC
[SECURITY] [DSA 4179-1] linux-tools security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian Security Advisory DSA-4179-1 secur...@debian.org https://www.debian.org/security/Ben Hutchings April 24, 2018https://www.debian.org/security/faq - - Package: linux-tools This update doesn't fix a vulnerability in linux-tools, but provides support for building Linux kernel modules with the "retpoline" mitigation for CVE-2017-5715 (Spectre variant 2). This update also includes bug fixes from the upstream Linux 3.16 stable branch up to and including 3.16.56. For the oldstable distribution (jessie), this problem has been fixed in version 3.16.56-1. We recommend that you upgrade your linux-tools packages. For the detailed security status of linux-tools please refer to its security tracker page at: https://security-tracker.debian.org/tracker/linux-tools Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-annou...@lists.debian.org -BEGIN PGP SIGNATURE- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlrfLWxfFIAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TCNBAAkmZlNuXx/bOIDLWZoKJvSUL6a8FylzBpdyFYILGcF8bU9CUjQM1M8QD1 bzl+kiWt6UJ5swpujfqfjkYTen4/42FYbMSrrAKy1wygCISyH5MrsKlymmOWNPK3 NVXzxKg4XAYoof16BvYvTavjOhsxHDqtTh0ehwLmqCpzTKvJ05miA8upxxQ1klmU LpsB3QoRaBnPm0qST4FUgEroZxvByTe3RqbHoYoRFXjV3ffmAnVyZKQF3p0PfpGZ zgt0MepINIk3mzpNBqpEFAGbB09mnEC/D8Jko/G0NTZgJzAUdEsauqOs7Q7sPlxb zuG1gS2oxKI+4uXw5mdUPPfWcQHkNTu6W3QaBVyw9D5S7MPUaSppNMgs53e0lCzP KGAwvV4f+tWvsSVSVKb6qXXdILLFo5FfmQRtwvB3d8dJpq8Zc3yDiL2RqPM9sSMz eZw/g2aN1OhVfPSglu53aVRfUok8rCxA3KujNG8vvzE8KoWp8aFauNH/XTlXe6ph o/8/urw2mPuPhGAiwOhgA3uUtsMaXpbvIjhkzO2bmJm19ewj7LW2S7/ufhBjNzvq Cte8X6V3+X20GIp4e4QIsdDlGeHYFBm+HOhPCDyWdZ/82AaWHsWKHP6QyKN6+c54 lX9EJ/g4wFt0Y8ueOgFf5d/Y1Ck9BcZp+Pc2TjEmtq5aOHHchYE= =4qrq -END PGP SIGNATURE-
SEC Consult SA-20180423-0 :: Multiple Stored XSS Vulnerabilities in WSO2 Carbon and Dashboard Server
SEC Consult Vulnerability Lab Security Advisory < 20180423-0 > === title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server 5.3.0 fixed version: WSO2 Identity Server 5.5.0 CVE number: CVE-2018-8716 impact: high homepage: https://wso2.com/products/dashboard found: 2017-12-13 by: W. Schober (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com === Vendor description: --- "WSO2 Carbon redefines middleware by providing an integrated and componentized middleware platform that adapts to the specific needs of any enterprise IT project - on premise or in the cloud. 100% open source and standards-based, WSO2 Carbon enables developers to rapidly orchestrate business processes, compose applications and develop services using WSO2 Developer Studio and a broad range of business and technical services that integrate with legacy, packaged and SaaS applications. The lean, complete, OSGi-based platform includes more than 175 components – OSGi bundles or Carbon features. The WSO2 Carbon core framework functions as “Eclipse for servers” and includes common capabilities shared by all WSO2 products, such as built-in registry, user management, transports, security, logging, clustering, caching and throttling services, co-ordination, and a GUI framework." Source: https://wso2.com/products/carbon/ "The WSO2 Dashboard Server (formerly WSO2 User Engagement Server) helps to rapidly create visually appealing and engaging web components such as dashboards, and gadgets, and unlocking data for business intelligence and monitoring. With the host of capabilities that Dashboard Server provides out-of-the-box, going from data to screen has never been easier." Source: https://wso2.com/products/dashboard-server/ Business recommendation: SEC Consult recommends to perform a thorough security review conducted by security professionals to identify and resolve all security issues. Vulnerability overview/description: --- 1) Stored Cross-Site Scripting in WSO2 Dashboard (CVE-2018-8716) The dashboard is used by the end-users to manage their accounts, change passwords, alter their profiles, or change certain settings. An attacker is able to inject arbitrary JavaScript payloads into various textboxes (username, home address, lastname, firstname, etc). The payloads are permanently stored in the dashboard and triggered every time the dashboard is visited. The payload is also potentially triggered in the carbon part of WSO2, which means that an attacker would be able to inject payloads from the front-end application into a middleware application, which is not accessible from the internet and attack administrators. 2) Stored Cross-Site Scripting in WSO2 Carbon The carbon UI offers a feature to add multiple BPS-Worker Hosts. In the worker host URL an arbitrary JavaScript payload can be injected and permanently stored in the web application. Proof of concept: - 1) Stored Cross-Site Scripting in WS02 Dashboard The following input fields are vulnerable and JavaScript payloads can be directly injected: - Firstname - Lastname - Username - Address It is suspected, that all user inputs are returned unfiltered in all server responses. 2) Stored Cross-Site Scripting in WSO2 Carbon To demonstrate the vulnerability, it is sufficient to add a new BPS worker and set the URL to the following payload: "> Everytime the carbon middleware application is accessed, the payload is triggered. Vulnerable / tested versions: - The following version has been tested which was the most recent version at the time of discovery: * WSO2IS 5.3.0 Vendor contact timeline: 2018-01-25: Contacting vendor through secur...@wso2.com 2018-02-08: Asking for status update. Vendor responds, that they are still investigating the issue. 2018-02-21: Vendor responds with release date and further details concerning the nature of the vulnerabilities. The XSS in the Carbon component was a duplicate and should be already fixed. Concerning the XSS in the dashboard a fix is implemented and will be rolled out with the release of WSO2 Identity Server 5.5.0. 2018-03-14: Requesting CVE from Mitre for the stored XSS in the Dashboard. 2018-03-15: Mitre assigned CVE-2018-8716. 2018-03-26: Vendor informed us, that the final release of the updated software will be on 5th of April. 2018-04-23: Public
