Upstream has issued 9 new security advisories today affecting 5.0.5: http://openwall.com/lists/oss-security/2013/05/14/8 These issues are fixed in 5.0.6. Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA3TOO
Updated packages uploaded for Mageia 3 and Cauldron. Advisory to come later, but please see the URL in Comment 0 for details. owncloud-5.0.6-1.mga3 is the updated package for testing.
CC: (none) => nicolas.lecureuilVersion: Cauldron => 3Assignee: nicolas.lecureuil => qa-bugsWhiteboard: MGA3TOO => (none)
Testing complete mga3 64 Owncloud doesn't restart httpd when it's installed so it is inaccessible until that is done manually which is possibly a bug so create bug 10275. The update performs a successful update when logged into owncloud at http://localhost/owncloud Created users, uploaded some files, viewed them, played with the settings, all ok.
Whiteboard: (none) => has_procedure mga3-64-OK
Testing complete mga3 32 Validating Could sysadmin please push from 3 core/updates_testing to core/updates SRPM owncloud-5.0.6-1.mga3 Advisory still required Thanks!
Keywords: (none) => validated_updateSource RPM: owncloud-5.0.5-1.mga3.src.rpm => owncloud-5.0.6-1.mga3.src.rpmWhiteboard: has_procedure mga3-64-OK => has_procedure mga3-64-OK mga3-32-okCC: (none) => sysadmin-bugs
Advisory: ======================== Updated owncloud package fixes security vulnerabilities: ownCloud before 5.0.6 does not neutralize special elements that are passed to the SQL query in lib/db.php which therefore allows an authenticated attacker to execute arbitrary SQL commands (CVE-2013-2045). ownCloud before 5.0.6 and 4.5.11 does not neutralize special elements that are passed to the SQL query in lib/bookmarks.php which therefore allows an authenticated attacker to execute arbitrary SQL commands (CVE-2013-2046). Multiple directory traversal vulnerabilities in (1) apps/files_trashbin/index.php via the "dir" GET parameter and (2) lib/files/view.php via undefined vectors in all ownCloud versions prior to 5.0.6 and other versions before 4.0.15, allow authenticated remote attackers to get access to arbitrary local files (CVE-2013-2039, CVE-2013-2085). Cross-site scripting (XSS) vulnerabilities in multiple files inside the media application via multiple unspecified vectors in all ownCloud versions prior to 5.0.6 and other versions before 4.0.15 allows authenticated remote attackers to inject arbitrary web script or HTML (CVE-2013-2040). Cross-site scripting (XSS) vulnerabilities in (1) apps/bookmarks/ajax/editBookmark.php via the "tag" GET parameter (CVE-2013-2041) and in (2) apps/files/js/files.js via the "dir" GET parameter to apps/files/ajax/newfile.php in ownCloud 5.0.x before 5.0.6 allows authenticated remote attackers to inject arbitrary web script or HTML (CVE-2013-2041). Cross-site scripting (XSS) vulnerabilities in (1) apps/bookmarks/ajax/addBookmark.php via the "url" GET parameter and in (2) apps/bookmarks/ajax/editBookmark.php via the "url" POST parameter in ownCloud 5.0.x before 5.0.6 allows authenticated remote attackers to inject arbitrary web script or HTML (CVE-2013-2042). Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 5.0.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter (CVE-2013-2044). Index.php (aka the login page) contains a form that does not disable the autocomplete setting for the password parameter, which makes it easier for local users or physically proximate attackers to obtain the password from web browsers that support autocomplete (CVE-2013-2047). Due to not properly checking the ownership of an calendar, an authenticated attacker is able to download calendars of other users via the "calendar_id" GET parameter to /apps/calendar/ajax/events.php. Note: Successful exploitation of this privilege escalation requires the "calendar" app to be enabled (enabled by default) (CVE-2013-2043). Due to an insufficient permission check, an authenticated attacker is able to execute API commands as administrator. Additionally, an unauthenticated attacker could abuse this flaw as a cross-site request forgery vulnerability (CVE-2013-2048). Incomplete blacklist vulnerability in ownCloud before 5.0.6 allows authenticated remote attackers to execute arbitrary PHP code by uploading a crafted file and accessing an uploaded PHP file. Note: Successful exploitation requires that the /data/ directory is stored inside the webroot and a webserver that interprets .htaccess files (e.g. Apache) (CVE-2013-2089). The configuration loader in ownCloud 5.0.x before 5.0.6 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information (CVE-2013-2086). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2039 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2049 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2041 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2042 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2043 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2044 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2045 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2046 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2047 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2048 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2085 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2086 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2089 http://owncloud.org/about/security/advisories/oC-SA-2013-019/ http://owncloud.org/about/security/advisories/oC-SA-2013-020/ http://owncloud.org/about/security/advisories/oC-SA-2013-021/ http://owncloud.org/about/security/advisories/oC-SA-2013-022/ http://owncloud.org/about/security/advisories/oC-SA-2013-023/ http://owncloud.org/about/security/advisories/oC-SA-2013-024/ http://owncloud.org/about/security/advisories/oC-SA-2013-025/ http://owncloud.org/about/security/advisories/oC-SA-2013-026/ http://owncloud.org/about/security/advisories/oC-SA-2013-027/ http://mailman.owncloud.org/pipermail/announcements/2013-May/000014.html http://mailman.owncloud.org/pipermail/announcements/2013-May/000012.html
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0154
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED
URL: (none) => http://lwn.net/Vulnerabilities/552028/