Onderwerp: Security, Open Source Style

Today we are excited to announce another community initiative--the Open
Source Software Security community (oss-security). This project is an
ongoing effort to manage security information in Open Source software by
building on the collaborative foundation of the open source model.

The purpose of oss-security is to encourage public discussion of security
flaws, concepts, and practices in the open source community. We don't want
to simply be an information clearinghouse, or to replace any of the current
security lists and groups. The goal is to fill an existing vacuum by
encouraging active participation of those interested in the ideas and
unique challenges in securing Open Source software. This includes
activities such as flaw discovery, understanding, reporting, and overall
best practices.

The oss-security community was initially founded by individuals from
Foresight Linux, Mandriva, Openwall, and Red Hat and has since grown to
include contributions from many other projects and individuals. The
computing resources are currently graciously donated by the Openwall
Project.

If you have an interest in the Open Source security space, you are
encouraged to participate in the oss-security community by adding content
to the wiki, contributing to mailing list discussions, or joining us on
IRC.

More information can be found on the group's wiki page here:
http://oss-security.openwall.org

Thank You.

--
JB

Vendor: Brown Bear Software
Vendor web page: http://brownbearsw.com/
Product: Calcium web calendar
Product web page: http://brownbearsw.com/calcium/WhatIsIt.html

Vendor's Product Description:
Calcium is a Web Calendar application. It will run on nearly any machine with a web server that can run Perl CGI scripts; a web browser is all you need to view, edit, and manage any number of calendars from any network connected computer. All administration is done with your browser - after installation, there's no need to log in to the web server.

Vulnerability class: Cross-Site Scripting
Severity: Medium

Vulnerability details:
Calcium web calendar is vulnerable to "reflected" (type 1) cross-site scripting (XSS). For a discussion of the various types of XSS, and XSS in general, see
http://en.wikipedia.org/wiki/Cross_Site_Scripting

Proof of concept, version 4.0.4:
https://[yourserver]/cgi-bin/Calcium...ookie)%3E_here

Impact:
Attacker could impersonate victim to do any activity the victim is authorized to do through a compromised web site, for example, initiate funds transfers or access private data. Under some circumstances the existence of this vulnerability in one web site could be used to attack other web sites in the same DNS domain. For example, if host "a.example.com" shares cookies with host "b.example.com" and "b" is vulnerable, "b" can be used to attack "a".

Versions tested:
Calcium 4.0.4 Vulnerable
Calcium 3.10 Vulnerable

Potential victims:
1. User web client with scripting languages enabled.
2. Web server hosting unpatched software.
3. Other web servers on the same DNS domain.

Workarounds:
1. Victim web client may disable scripting languages.
2. Vulnerable web site may temporarily shut down until patch can be applied.
3. Exposed web sites sharing the same DNS domain should not share authentication cookies with vulnerable site.

Researcher's quick patch for version 4.0.4:
Until vendor patch is received, this may help. Use at your own risk.
In file cgi-bin/CalciumDir40/Calendar/Database.pm
72c72
< die "Bad Calendar or Database name! '$dbName' \n"
---
> die "Bad Calendar or Database name!\n"

Vendor response:
Vendor provided a patch by email.

Local access to victim computer required: NO.

Victim user assistance required:
YES. For example, victim can be enticed to visit a malicious web page or open a malicious email.

Authentication required:
NO. Attack can be carried out by an unauthenticated attacker against an unauthenticated victim. However, if the victim has authenticated to a web site, the attacker may be able to steal the victim's authentication credentials and use them to access the victim's private information and/or complete any action that the victim is authorized to perform on that web site, or on other web sites in the same DNS domain that share authentication cookies.

Disclosure Timeline:
2008-05-13 Vulnerability discovered.
2008-05-14 Vendor notified.
2008-05-14 Initial vendor response.
2008-05-22 Vendor provided patch for version 4.0.4.
2008-05-23 Vendor provided patch for version 3.10.
2008-05-28 Vendor commented on draft of this disclosure.
2008-05-28 Public disclosure.

Disclaimer:
All information is thought to be correct as of the time of disclosure, however, this information is provided without any assurance as to its accuracy or reliability.

The purpose of this disclosure is to alert users who may be at risk, and empower them to test their own systems, with the goal of improving Internet security for all. It may be illegal to use this information to test systems you do not own.

You are responsible for what you do with this information. No one else accepts liability for what you do.

Credit: Discovered by Marvin Simkin.

About the author:
Marvin Simkin was one of several security researchers to independently discover "reflected" (type 1) XSS and participate in responsible disclosure in 1999. At the time of discovery, available statistics suggested that at least 95% of all web sites on the Internet were vulnerable.

-------------------------------------
Marvin Simkin
Manager of Information Technology
School of Earth and Space Exploration
Arizona State University
http://simkin.asu.edu/