The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings from a cookie.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which     allows a remote authenticated attacker to perform file deletions (in the context of the user account that     runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings     from a cookie. (CVE-2019-14466)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4609-1 advisory.

    Fabian Henneke discovered that GOsa incorrectly handled client cookies. An authenticated user could     exploit this with a crafted cookie to perform file deletions in the context of the user account that runs     the web server. (CVE-2019-14466)

    It was discovered that GOsa incorrectly handled user access control. A remote attacker could use this     issue to log into any account with a username containing the word success. (CVE-2019-11187)

    Fabian Henneke discovered that GOsa was vulnerable to cross-site scripting attacks via the change password     form. A remote attacker could use this flaw to run arbitrary web scripts. (CVE-2018-1000528)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

GOsa&sup2; used unserialize to restore filter settings from a cookie.
Since this cookie was supplied by the client, authenticated users could have passed arbitrary content to unserialized, which opened GOsa&sup2; up to a potential PHP object injection.

For Debian 8 'Jessie', this problem has been fixed in version 2.7.4+reloaded2-1+deb8u5.

We recommend that you upgrade your gosa packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
251159	Linux Distros Unpatched Vulnerability : CVE-2019-14466	Nessus	Misc.	Local	medium
142026	Ubuntu 16.04 LTS : GOsa vulnerabilities (USN-4609-1)	Nessus	Ubuntu Local Security Checks	Local	critical
128425	Debian DLA-1905-1 : gosa security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-14466

medium

Tenable Plugins

medium

critical

medium