SB2014050806 - Multiple vulnerabilities in caldera

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2014-2933)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in dirmng/index.php in Caldera 9.20. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to access arbitrary directories via a crafted pathname.

2) SQL injection (CVE-ID: CVE-2014-2934)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

3) OS Command Injection (CVE-ID: CVE-2014-2935)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.

4) Code Injection (CVE-ID: CVE-2014-2936)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.

Remediation

Install update from vendor's website.

References

• http://www.kb.cert.org/vuls/id/693092
• http://www.securityfocus.com/bid/67252
• http://www.securityfocus.com/bid/67254