PT-2015-2572 · Owncloud · Owncloud Server

Published 2015-08-13 · Updated 2015-10-22 · CVE-2015-4717

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions ownCloud Server versions 6.0.0 through 6.0.7 ownCloud Server versions 7.0.0 through 7.0.5 ownCloud Server versions 8.0.0 through 8.0.3

Description The issue is related to the filename sanitization component, which does not properly handle $ GET parameters cast by PHP to an array. This allows remote attackers to cause a denial of service via crafted endpoint file names, resulting in an infinite loop and log file consumption.

Recommendations For ownCloud Server versions 6.0.0 through 6.0.7, update to version 6.0.8 or later. For ownCloud Server versions 7.0.0 through 7.0.5, update to version 7.0.6 or later. For ownCloud Server versions 8.0.0 through 8.0.3, update to version 8.0.4 or later.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11937

CVE-2015-4717

DSA-3373-1

MGASA-2015-0314

Affected Products

Owncloud Server

References · 31

• https://bdu.fstec.ru/vul/2015-11945 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5954 · Security Note
• https://owncloud.org/security/advisory/?id=oc-sa-2015-007 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5953 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4717 · Security Note
• https://bdu.fstec.ru/vul/2015-11937 · Security Note
• https://osv.dev/vulnerability/DSA-3373-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11826 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0314 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4718 · Security Note
• https://bdu.fstec.ru/vul/2015-11827 · Security Note
• http://debian.org/security/2015/dsa-3373 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11943 · Security Note
• https://security-tracker.debian.org/tracker/DSA-3373-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6500 · Security Note