SB2017030902 - Multiple vulnerabilities in dnaTools, dnaLIMS

Description

This security bulletin contains information about 3 vulnerabilities.

1) Path traversal (CVE-ID: CVE-2017-6527)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user (by using the viewAppletFsa.cgi seqID parameter).

2) Insufficiently protected credentials (CVE-ID: CVE-2017-6528)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).

3) Insufficient Session Expiration (CVE-ID: CVE-2017-6529)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

Remediation

Install update from vendor's website.

References

• http://www.securityfocus.com/bid/96823
• https://www.exploit-db.com/exploits/41578/
• https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/