PT-2017-10154 · Owncloud+1 · Owncloud Server+1

Dwight Hohnstein · Publicado 2017-03-28 · Atualizado 2019-10-09 · CVE-2016-9463

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 9.0.54 Nextcloud Server versions prior to 10.0.1 ownCloud Server versions prior to 9.1.2 ownCloud Server versions prior to 9.0.6 ownCloud Server versions prior to 8.2.9

Description The issue allows an unauthenticated attacker to gain access to an account without valid credentials by exploiting the SMB user authentication bypass in the SMB authentication component. This component is optional and not enabled by default, requiring manual configuration in the config file. The problem arises because the backend does not properly handle SMB servers with anonymous authentication configured, which is the default setting for most SMB servers.

Recommendations For Nextcloud Server versions prior to 9.0.54, update to version 9.0.54 or later. For Nextcloud Server versions prior to 10.0.1, update to version 10.0.1 or later. For ownCloud Server versions prior to 9.1.2, update to version 9.1.2 or later. For ownCloud Server versions prior to 9.0.6, update to version 9.0.6 or later. For ownCloud Server versions prior to 8.2.9, update to version 8.2.9 or later. As a temporary workaround, consider disabling the SMB backend until a patch is available.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-303

Identificadores relacionados

CVE-2016-9463

Produtos afetados

Nextcloud Server

Owncloud Server

Referências · 12

• 🔥 https://hackerone.com/reports/148151 · Exploit
• 🔥 https://rhinosecuritylabs.com/2016/10/operation-ownedcloud-exploitation-post-exploitation-persistence · Exploit
• https://github.com/owncloud/apps/commit/5d47e7b52646cf79edadd78ce10c754290cbb732 · Correção
• https://github.com/owncloud/apps/commit/a0e07b7ddd5a5fd850a6e07f8457d05b76a300b3 · Correção
• https://github.com/owncloud/apps/commit/16cbccfc946c8711721fa684d78135ca1fb64791 · Correção
• https://github.com/nextcloud/apps/commit/b85ace6840b8a6704641086bc3b8eb8e81cb2274 · Correção
• https://github.com/nextcloud/apps/commit/decb91fd31f4ffab191cbf09ce4e5c55c67a4087 · Correção
• https://nextcloud.com/security/advisory/?id=nc-sa-2016-006 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9463 · Nota
• https://owncloud.org/security/advisory/?id=oc-sa-2016-017 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9463 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9463 · Aviso do Fabricante