Flooding logfiles with a 1 Bit BMP File

 

Risk level: Medium

CVSS v3 Base Score: 4.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N)

CWE: Logging of Excessive Data (CWE-779)

Description

An Attacker can upload a 1 Bit BMP File and the server hangs and doesn’t stop to populate a logfile

Affected Software

• ownCloud Server < 9.1.3 (CVE-2017-5867)
  • core/0f1da72db6cd3ca08d166d96c57f39b8563d048f
• ownCloud Server < 9.0.7 (CVE-2017-5867)
  • core/69fcf706fc7125c028b87fe8224a544ff124dc4b
• ownCloud Server < 8.2.9 (CVE-2017-5867)
  • core/83da5e2ce952c042abb9ba88c293795b750cde89
• ownCloud Server < 8.1.11 (CVE-2017-5867)
  • core/45fc1aa6f9200fe55e417eed02e18c965fe09872

Action Taken

Suppress error messages with 1 Bit BMP Files

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

• Temtaime – Vulnerability discovery and disclosure.