ownCloud 'user_ldap' Authentication Bypass Vulnerability
BID:71373
Info
ownCloud 'user_ldap' Authentication Bypass Vulnerability
| Bugtraq ID: | 71373 |
| Class: | Design Error |
| CVE: |
CVE-2014-9043 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 25 2014 12:00AM |
| Updated: | May 07 2015 05:24PM |
| Credit: | Lukas Reschke |
| Vulnerable: |
ownCloud ownCloud 7.0.2 ownCloud ownCloud 7.0.1 ownCloud ownCloud 7.0 ownCloud ownCloud 6.0.4 ownCloud ownCloud 6.0.1 ownCloud ownCloud 5.0.11 ownCloud ownCloud 5.0.10 ownCloud ownCloud 5.0.8 ownCloud ownCloud 5.0.7 ownCloud ownCloud 5.0.6 ownCloud ownCloud 5.0.5 ownCloud ownCloud 5.0.4 ownCloud ownCloud 5.0.3 ownCloud ownCloud 5.0.1 ownCloud ownCloud 5.0 ownCloud ownCloud 4.5.13 ownCloud ownCloud 4.5.12 ownCloud ownCloud 4.5.11 ownCloud ownCloud 4.5.10 ownCloud ownCloud 4.5.9 ownCloud ownCloud 4.5.8 ownCloud ownCloud 4.5.7 ownCloud ownCloud 4.5.2 ownCloud ownCloud 4.5 ownCloud ownCloud 4.0.16 ownCloud ownCloud 4.0.15 ownCloud ownCloud 4.0.14 ownCloud ownCloud 4.0.13 ownCloud ownCloud 4.0.12 ownCloud ownCloud 4.0.9 ownCloud ownCloud 4.0.7 ownCloud ownCloud 4.0.6 ownCloud ownCloud 4.0.5 ownCloud ownCloud 4.0.4 ownCloud ownCloud 6.0.5 ownCloud ownCloud 6.0.3 ownCloud ownCloud 6.0.2 ownCloud ownCloud 6.0.0a ownCloud ownCloud 6.0.0 ownCloud ownCloud 5.0.9 ownCloud ownCloud 5.0.2 ownCloud ownCloud 5.0.17 ownCloud ownCloud 5.0.16 ownCloud ownCloud 5.0.15 ownCloud ownCloud 5.0.14 A ownCloud ownCloud 5.0.14 ownCloud ownCloud 5.0.13 ownCloud ownCloud 5.0.12 ownCloud ownCloud 4.5.6 ownCloud ownCloud 4.5.5 ownCloud ownCloud 4.5.4 ownCloud ownCloud 4.5.3 ownCloud ownCloud 4.5.1 ownCloud ownCloud 4.0.8 ownCloud ownCloud 4.0.3 ownCloud ownCloud 4.0.2 ownCloud ownCloud 4.0.11 ownCloud ownCloud 4.0.10 ownCloud ownCloud 4.0.1 ownCloud ownCloud 4.0.0 ownCloud ownCloud 3.0.3 ownCloud ownCloud 3.0.2 ownCloud ownCloud 3.0.1 ownCloud ownCloud 3.0.0 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 |
| Not Vulnerable: |
ownCloud ownCloud 7.0.3 ownCloud ownCloud 6.0.6 ownCloud ownCloud 5.0.18 |
Discussion
ownCloud 'user_ldap' Authentication Bypass Vulnerability
ownCloud is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication process and gain unauthorized access to the system. Successfully exploiting this issue may lead to further attacks.
Versions prior to ownCloud 7.0.3, 6.0.6 and 5.0.18 are vulnerable.
ownCloud is prone to an authentication-bypass vulnerability.
An attacker can exploit this issue to bypass the authentication process and gain unauthorized access to the system. Successfully exploiting this issue may lead to further attacks.
Versions prior to ownCloud 7.0.3, 6.0.6 and 5.0.18 are vulnerable.
Exploit / POC
ownCloud 'user_ldap' Authentication Bypass Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
ownCloud 'user_ldap' Authentication Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva owncloud-5.0.19-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/