PT-2014-5079 · Ibm · Ibm Sametime Meeting Server

Published 2014-07-01 · Updated 2017-01-07 · CVE-2014-3088

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Sametime Meeting Server version 8.5.1

Description The issue allows remote authenticated users to bypass intended upload restrictions. This is achieved by modifying the Content-Type header and file extension in wAttach?OpenForm multipart/form-data POST requests, which are not properly validated by the server. For example, an attacker could replace a text/plain .txt upload with an application/octet-stream .exe upload.

Recommendations For IBM Sametime Meeting Server version 8.5.1, consider validating file formats on the server-side to prevent bypassing of upload restrictions. As a temporary workaround, restrict access to the stconf.nsf file and the wAttach?OpenForm endpoint to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3088

Affected Products

Ibm Sametime Meeting Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-3088 · Security Note
• http://linux.oracle.com/errata/ELSA-2014-0747.html · Note
• http://securityfocus.com/bid/68291 · Note
• http://packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html · Note
• http://packetstormsecurity.com/files/127294 · Note