PT-2015-2572 · Owncloud · Owncloud Server

Publicado

2015-08-13

·

Atualizado

2015-10-22

·

CVE-2015-4717

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.7 ownCloud Server versions 7.0.0 through 7.0.5 ownCloud Server versions 8.0.0 through 8.0.3
Description The issue is related to the filename sanitization component, which does not properly handle $ GET parameters cast by PHP to an array. This allows remote attackers to cause a denial of service via crafted endpoint file names, resulting in an infinite loop and log file consumption.
Recommendations For ownCloud Server versions 6.0.0 through 6.0.7, update to version 6.0.8 or later. For ownCloud Server versions 7.0.0 through 7.0.5, update to version 7.0.6 or later. For ownCloud Server versions 8.0.0 through 8.0.3, update to version 8.0.4 or later.

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-11937
CVE-2015-4717
DSA-3373-1
MGASA-2015-0314

Produtos afetados

Owncloud Server