copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2015.2626 - [UNIX/Linux] owncloud: Multiple vulnerabilities

Date: 19 October 2015
References: ESB-2015.1661  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2626
                         owncloud security update
                              19 October 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           owncloud
Publisher:         Debian
Operating System:  UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account            
                   Denial of Service               -- Remote/Unauthenticated      
                   Cross-site Scripting            -- Remote with User Interaction
                   Access Confidential Data        -- Existing Account            
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-7699 CVE-2015-6670 CVE-2015-6500
                   CVE-2015-5954 CVE-2015-5953 CVE-2015-4718
                   CVE-2015-4717 CVE-2015-4716 

Reference:         ESB-2015.1661

Original Bulletin: 
   http://www.debian.org/security/2015/dsa-3373

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running owncloud check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3373-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
October 18, 2015                      https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : owncloud
CVE ID         : CVE-2015-4716 CVE-2015-4717 CVE-2015-4718 CVE-2015-5953 
                 CVE-2015-5954 CVE-2015-6500 CVE-2015-6670 CVE-2015-7699
Debian Bug     : 800126

Multiple vulnerabilities were discovered in ownCloud, a cloud storage
web service for files, music, contacts, calendars and many more. These
flaws may lead to the execution of arbitrary code, authorization bypass,
information disclosure, cross-site scripting or denial of service.

For the stable distribution (jessie), these problems have been fixed in
version 7.0.4+dfsg-4~deb8u3.

For the testing distribution (stretch), these problems have been fixed
in version 7.0.10~dfsg-2 or earlier versions.

For the unstable distribution (sid), these problems have been fixed in
version 7.0.10~dfsg-2 or earlier versions.

We recommend that you upgrade your owncloud packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWI6MYAAoJEAVMuPMTQ89EnbEP/A9DPQ1tc0sfuCIftdJ47ws/
7JFSk/diT1TOJhA6jTEN7V4bHZXitUGwVxoM1AyB7YNf3puNp3LITUXJ0sH3ELhi
XxvrsJqwianWsDvAFDtG1K0WXgC10hWsv/f2GqRkpFycbOd6xcqioewHAicS5rJt
Rmfdbf0DmZEN4v9nhHr64DqXGmmu9igWPZuX4qZ4MjakD+724+s8/OWv0kuv6Xr4
pIM2QTjtZKZBmQd5I+JTFjX7rAz9paYRXYVQXoxmBhry4YGBHEfeomv3pknRUrFr
3pKLLbt8ixfImzLxIILftRnCZwHISqJmVE4jPD5i9U9YkIS+Ga8Z9+asslrgnddy
WTwIKN/Gwe12n5BKZ8n8jcpAfBP1F164HEfGqLjKAQJzJCDCy/tsKjQUQaueFhie
6A4ORmG3MgC0pfaJe+xh9NLoyO2Hi0huekU5z1BN2klDz5c690Ls8GJVx3MPjc2o
fOfVweifDKM3xGsw6e5gDDbioOnEic7v/x7E15VeqYP4rMyRbEt/nxQoXaMt0OM3
EblI7F+7npNH+PoYzLRWdXT1PiYWiZurq+uqhM0TKjAqNLZ1lXXvibehTJKQOxwn
O7I7Thg3jrjVQaj13zy8l0zUFXRByV01nzF+0xhOceGKoi1OaroEJ1+17pv4V9ob
MFyvPGb0pNnJIsQmMefT
=TkN9
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBViRCZX6ZAP0PgtI9AQJLwg//d0Flk4Oqztsih1sy0Ouqr2auImSrQQcK
XueheZcECGgkKDQK1BcUtgquogalkxJJ0Al0b8LKkzDn7EuBppqzEAKV+s+kut0S
vjkDS2aymSKPU9/NZsshzrMG1VjZkpr3BcaC9zSpS8kSi8csjCusGETiafuHSmxw
NNHB1wmZcNuETHkuj32f4+N6KXEahTIdgUptZp0oxm35U8xB+IfRR/jsncPydQpE
Jtigmi+D9KrWOhU8TXvCdm3dY9LRMrq8HPBDcV0rizYGLLhOAf38FqCEEw6DqdhZ
5UbJrQwha3It/N4AzegqcF4UFyAcxvK/deRmh2YazjOoTG5u5vVd36RN6e9BNLIC
ZBFgZEb1iNRBnLsspFYzrxwCVpV2Cr8KQDYkqZC6UzzijwFQg2f2He6UuxTRw7JU
is4c4gOgcGpZvmMThmMq5dM2jj1xYwD2klGJEyMFifMg2VTWQ8SW/XHh29xB0TNk
eyo0rkgAt800SK2Vs00sFzL7Rt1CDJQra2NPNhMoih9d0ElYR9HNzuXTs48gbBBX
98hykcx1VB7/6gYO1CaVRXakir5BF1J3aZQ3urg/eqqXQyRXQ21GjpUFiUWolH+H
RxJU38FBwjZgnVbHNSOAeNw+9eK54UXK9WyPLBYv9ZeBz2Cmr669VIXV1Z7K+iEG
OIPi+hlQBUw=
=6TfY
-----END PGP SIGNATURE-----