Bug 1274243 (CVE-2015-7698)

Summary:	CVE-2015-7698 owncloud: Command injection when using external SMB storage
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	awilliam, ignatenko, shawn
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-10-22 15:23:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1274246, 1274247
Bug Blocks:

Description Adam Mariš 2015-10-22 10:58:12 UTC

The external legacy SMB storage (not using php-libsmbclient) of ownCloud was not properly neutralizing all special elements which allows an adversary to execute arbitrary SMB commands. Effectively this allows an attacker to gain access to any file on the system or overwrite it, potentially leading to a PHP code execution.

Affects: owncloud < 8.1.2

Comment 1 Adam Mariš 2015-10-22 11:03:00 UTC

Created owncloud tracking bugs for this issue:

Affects: fedora-all [bug 1274246]
Affects: epel-all [bug 1274247]

Comment 2 Adam Williamson 2015-10-22 15:23:07 UTC

We do not ship ownCloud 8.1, and this bug only affects the 8.1 series, AFAICT. Even if it did affect the 8.0 or 7.0 series, there have been multiple stable releases of both those series since 8.1.2 came out, and a security fix would certainly have been backported to those if it were relevant.