SB2017022020 - Information disclosure in zoneminder (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Information disclosure (CVE-ID: CVE-2017-5595)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local authenticated user to gain access to sensitive information.

A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-input being passed to readfile(), which allows an authenticated attacker to read local system files (e.g., /etc/passwd) in the context of the web server user (www-data). The attack vector is a .. (dot dot) in the path parameter within a zm/index.php?view=file&path= request.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=324d2ab366311bfe36c0f674594330bc7290fec5
• https://git.alpinelinux.org/aports/commit/?id=5aeeee9343fdca5daa5b325ab5e19f228071dd3f