SB2017102415 - Multiple vulnerabilities in Cloud Foundry UAA

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Cross-site request forgery (CVE-ID: CVE-2015-5170)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

2) Insufficient Session Expiration (CVE-ID: CVE-2015-5171)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions.

3) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2015-5172)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links.

4) Information disclosure (CVE-ID: CVE-2015-5173)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."

Remediation

Install update from vendor's website.

References

• http://www.securityfocus.com/bid/101579
• https://pivotal.io/security/cve-2015-5170-5173