PT-2016-5813 · Open Xchange · Open-Xchange Ox Guard

Published 2016-12-15 · Updated 2018-10-19 · CVE-2016-4028

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open-Xchange OX Guard versions prior to 2.4.0-rev8

Description An issue in Open-Xchange OX Guard allows attackers to guess the correct padding of the authentication token by exploiting the API's behavior as a padding oracle. This is possible due to the use of AES-CBC encryption. Attackers can run brute-forcing attacks on the content of the guest authentication token to discover user credentials. For a practical attack, the attacker needs to know the content of the guest user's OxReaderID cookie and the value of the auth parameter.

Recommendations For versions prior to 2.4.0-rev8, update to version 2.4.0-rev8 or later to resolve the issue. As a temporary workaround, consider restricting access to the OX Guard API to minimize the risk of exploitation. Avoid using the auth parameter in the affected API endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2016-4028

Affected Products

Open-Xchange Ox Guard

References · 4

• https://osv.dev/vulnerability/CVE-2016-4028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4028 · Security Note
• http://securitytracker.com/id/1036154 · Note
• http://securityfocus.com/archive/1/538732/100/0/threaded · Note