Roundup XML-RPC Server Security Bypass Vulnerability

Bugtraq ID:	28238
Class:	Access Validation Error
CVE:	CVE-2008-1475
Remote:	Yes
Local:	No
Published:	Mar 06 2008 12:00AM
Updated:	Apr 13 2015 09:48PM
Credit:	Philipp Gortan reported this issue.
Vulnerable:	Roundup Roundup 1.4.4 Roundup Roundup 1.4.3 Roundup Roundup 1.4.2 Roundup Roundup 1.4.1 Roundup Roundup 1.4 Gentoo www-apps/roundup 1.4.4
Not Vulnerable:

Roundup XML-RPC Server Security Bypass Vulnerability

Roundup is prone to a security-bypass vulnerability.

An attacker can exploit this issue to access and modify sensitive information that may help in further attacks.

This issue affects Roundup 1.4.4; other versions may be vulnerable as well.

Roundup XML-RPC Server Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Roundup XML-RPC Server Security Bypass Vulnerability

Solution:
The vendor has released a CVS fix. Please see the references for more information.

Roundup XML-RPC Server Security Bypass Vulnerability

References:

• Roundup Homepage (Roundup)
  
• View of /roundup/CHANGES.txt (Roundup)
  
• [ 1907211 ] xmlrpc-server not checking property permissions (Roundup)