SSD Advisory – SquirrelMail Remote Code Execution

Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom

Vulnerability Summary
The following advisory describes Remote Code Execution found in SquirrelMail version 1.4.22.

SquirrelMail is a standards-based webmail package written in PHP. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. SquirrelMail has all the functionality you would want from an email client, including strong MIME support, address books, and folder manipulation.

Credit
An independent security researcher, Dawid Golunski (https://legalhackers.com/), has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor Responses
SquirrelMail has released patches to address this vulnerability, for more details see: https://squirrelmail.org/security/issue/2017-04-24

Continue reading SSD Advisory – SquirrelMail Remote Code Execution

SSD Advisory – Emby Media Server Multiple Vulnerabilities

Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom

Vulnerabilities Summary
The following advisory describes three (3) vulnerabilities found in Emby Media Server.

Affected versions are: 3.1.5, 3.1.2, 3.1.1, 3.1.0 and 3.0.0.

Emby Media Server (formerly Media Browser) is a media server designed to organize, play, and stream audio and video to a variety of devices. Emby is open-source, and uses a client server model. Two comparable media servers are Plex and Windows Media Center.

The vulnerabilities found in Emby Media Server are:

  • Directory Traversal
  • File Disclosure
  • SQL Injection

Credit
An independent security researcher Gjoko Krstic from Zero Science Lab has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor Response
Emby has been notified in March 2017 about the vulnerability, shortly after they have released a new version that addresses this vulnerabilities. They however have not provided any version information or release notes that reflect this.

Continue reading SSD Advisory – Emby Media Server Multiple Vulnerabilities

SSD Advisory – HPE OpenCall Media Platform (OCMP) Multiple Vulnerabilities

Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom

Vulnerabilities Summary
The following advisory describes Reflected Cross-Site Scripting (XSS) vulnerabilities and a Remote File Inclusion vulnerability that when combined can lead to arbitrary Javascript code execution, were found in HP OpenCall Media Platform (OCMP), version 4.3.2.

HPE OpenCall Media Platform (OCMP) is a suite of software and hardware applications which allow implementation of common telecom operator services such as voicemail, sms (short message service), prepaid, billing, hlr, etc. It implements industry standard telecom protocols and standards such as SS7, ISUP, TCAP, SIP, MRCP, RTSP, and VoiceXML.

HPE OpenCall Media Platform offers a highly scalable, easy-to-manage, carrier-grade media platform that adapts to future networks and applications. Through its strong support of open standards and protocols, new applications can be rapidly developed and deployed in a way that preserves investments and reduces capital expenditures (CAPEX) and operational expenditure (OPEX).

There are 3 different components that are vulnerable in HPE OpenCall Media Platform (OCMP), and for each component has the following vulnerabilities:

  • Application Content Manager
  1. Reflected Cross-Site Scripting (XSS) – /mcm/resources/


  • Platform Administration Tool
  1. Reflected Cross-Site Scripting (XSS) that leads to arbitrary Javascript code execution
  2. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE0 parameter
  3. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE1 parameter
  4. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE2 parameter
  5. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_TYPE3 parameter
  6. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME0 parameter
  7. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME1 parameter
  8. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME2 parameter
  9. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NAME3 parameter
  10. Reflected Cross-Site Scripting (XSS) – GetMapAction function
  11. Reflected Cross-Site Scripting (XSS) – GetMapAction function, LEV_NUM parameter
  12. Reflected Cross-Site Scripting (XSS) – GetMapAction function, NAME parameter
  13. Reflected Cross-Site Scripting (XSS) – cdrdispatch function, next parameter
  14. Reflected Cross-Site Scripting (XSS) – cdrdispatch function, sessionType parameter


  • VoiceXML Administration Tool
  1. Reflected Cross-Site Scripting (XSS) – event.do function
  2. Reflected Cross-Site Scripting (XSS) – call.do function
  3. Remote File Inclusion – proxylink.do function


Credit
An independent security researcher Paolo Stagno from VoidSec has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vendor Responses
HPE has released patches to address this vulnerability, for more details see:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbgn03686en_us

Continue reading SSD Advisory – HPE OpenCall Media Platform (OCMP) Multiple Vulnerabilities

Security conferences – Survival guide 2017 Q3

The security conferences “Survival guide” for 2017 Q3 is here!

We have gathered the following information for you for each conference:

  • Dates
  • Place
  • Link to official conference website
  • Ticket price
  • Lectures
  • Workshops

So let’s get started:

Continue reading Security conferences – Survival guide 2017 Q3