SB2024062768 - Multiple vulnerabilities in BigBlueButton

Description

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2024-39302)

CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper file permissions in /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 when accessing files in the directory. A remote attacker can exploit overly elevated file permissions to cause a denial of service.

The issue may be leveraged for privilege escalation and could expose sensitive information on the server.

2) Improper access control (CVE-ID: CVE-2024-38518)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper access control in the join API when handling additional parameters in join requests. A remote user can supply a crafted join link with additional parameters to disclose sensitive information and cause a denial of service.

User interaction is required because the issue involves use of a valid join link to a meeting.

Remediation

Install update from vendor's website.

References

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4