CYBSEC Security Advisory: Arbitrary file overwrite in Documentum

[CYBSEC Advisories]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigCB04A14BA1D43C2640FE4BDB
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

The following pre-advisory is also available in PDF format for download a=
t:
http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_Documentum_dmclTrace_=
Arbitrary_file_overwrite.pdf


Advisory Name: Arbitrary file overwrite in Documentum Administrator / Doc=
umentum Webtop
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Vulnerability Class: Arbitrary file overwrite
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D


Release Date: 2008-02-05
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Affected Applications:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
* Documentum Administrator version 5.3.0.313
* Documentum Webtop version version 5.3.0.317
* Other applications and versions may also be affected


Affected Platforms:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D
* Windows 2003 Server - Standard Edition
* Apache Tomcat 5.0.28
* Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.2_05-b04)
* Other platforms may also be affected


Local / Remote: Remote
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Severity: High
=3D=3D=3D=3D=3D=3D=3D=3D=3D


Author: Pablo Gaston Milano
=3D=3D=3D=3D=3D=3D=3D


Vendor Status: Confirmed. Updates Released.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulne=
rability_policy.pdf
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D


Vulnerability Description:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Documentum Administrator and Documentum Webtop were found to be vulnerabl=
e to arbitrary file overwrite, by specifying an arbitrary filename attrib=
ute
to the =93dmclTrace.jsp=94 page. It is also possible to control the conte=
nts of the overwritten file, which could allow the remote upload and exec=
ution of
arbitrary code in the context of the user running the application server.=



Impact:
=3D=3D=3D=3D=3D=3D=3D
Exploitation of this vulnerability would allow an attacker to overwrite a=
rbitrary files on the server filesystem. This could be used to upload and=

execute arbitrary code in the context of the user running the application=
server.


Solution:
=3D=3D=3D=3D=3D=3D=3D=3D=3D
The vendor reported that this vulnerability was fixed in SP4 and later.


Vendor Response:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=2E 2007-12-17: CYBSEC contacted Vendor.
=2E 2007-12-17: Vendor first response.
=2E 2008-01-04: Vendor confirmed vuln is fixed in latest SP.
=2E 2008-01-30: CYBSEC informed the vendor the disclosure plan.
=2E 2008-02-05: Advisory Public Disclosure.


Contact Information:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D
For more information regarding the vulnerability feel free to contact the=
researcher at pmilano <at> cybsec <dot> com.



About CYBSEC S.A. Security Systems
-----------------------------------

Since 1996 CYBSEC S.A. is devoted exclusively to provide professional ser=
vices specialized in Computer Security. More than 150 clients around the
globe validate our quality and professionalism.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is=
associated with other software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our=
clients from emerging security threats, mantaining their IT deployments
available, safe, and reliable.
Beyond professional services, CYBSEC is continuosly researching new defen=
se and attack techiniques and contributing with the security community wi=
th
high quality information exchange.
=09
For more information, please visit www.cybsec.com

(c) 2008 - CYBSEC S.A. Security Systems










--------------enigCB04A14BA1D43C2640FE4BDB
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHqLGxvWPewvmdrSgRAqeRAJ47pXnDjcaGwRUpZaV61V d2SjRHwACfSjlV
hIkg8kFZ/iIQnrczITor3sw=
=gcNT
-----END PGP SIGNATURE-----

--------------enigCB04A14BA1D43C2640FE4BDB--