Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4609-1 advisory.

    Fabian Henneke discovered that GOsa incorrectly handled client cookies. An authenticated user could     exploit this with a crafted cookie to perform file deletions in the context of the user account that runs     the web server. (CVE-2019-14466)

    It was discovered that GOsa incorrectly handled user access control. A remote attacker could use this     issue to log into any account with a username containing the word success. (CVE-2019-11187)

    Fabian Henneke discovered that GOsa was vulnerable to cross-site scripting attacks via the change password     form. A remote attacker could use this flaw to run arbitrary web scripts. (CVE-2018-1000528)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In GOsa&sup2;, an LDAP web-frontend written in PHP, a vulnerability was found that could theoretically have lead to unauthorized access to the LDAP database managed with FusionDirectory. LDAP queries' result status ('Success') checks had not been strict enough. The resulting output containing the word 'Success' anywhere in the returned data during login connection attempts would have returned 'LDAP success' to FusionDirectory and possibly grant unwanted access.

For Debian 8 'Jessie', this problem has been fixed in version 2.7.4+reloaded2-1+deb8u4.

We recommend that you upgrade your gosa packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In FusionDirectory, an LDAP web-frontend written in PHP (originally derived GOsa&sup2; 2.6.x), a vulnerability was found that could theoretically lead to unauthorized access to the LDAP database managed with FusionDirectory. LDAP queries' result status ('Success') checks had not been strict enough. The resulting output containing the word 'Success' anywhere in the returned data during login connection attempts would have returned 'LDAP success' to FusionDirectory and possibly grant unwanted access.

For Debian 8 'Jessie', this problem has been fixed in version 1.0.8.2-5+deb8u2.

We recommend that you upgrade your fusiondirectory packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
142026	Ubuntu 16.04 LTS : GOsa vulnerabilities (USN-4609-1)	Nessus	Ubuntu Local Security Checks	critical
127485	Debian DLA-1876-1 : gosa security update	Nessus	Debian Local Security Checks	critical
127484	Debian DLA-1875-1 : fusiondirectory security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-11187

critical

Tenable Plugins

critical

critical

critical