CVE-2013-1941

The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://owncloud.org/about/security/advisories/oC-SA-2013-015/	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:owncloud:owncloud:4.0.11:::::::*
	cpe:2.3:a:owncloud:owncloud::::::::
	cpe:2.3:a:owncloud:owncloud:4.0.6:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.8:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.2:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.3:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.4:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.5:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.0:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.1:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.10:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.9:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.7:::::::*
	cpe:2.3:a:owncloud:owncloud:4.0.12:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:owncloud:owncloud:4.5.4:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.6:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.8:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.0:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.1:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.2:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.3:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.5:::::::*
	cpe:2.3:a:owncloud:owncloud:4.5.7:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:owncloud:owncloud:5.0.3:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.0:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.1:::::::*
	cpe:2.3:a:owncloud:owncloud:5.0.2:::::::*

Information

Published : 2014-06-04 07:55

Updated : 2014-06-04 11:18

NVD link : CVE-2013-1941

Mitre link : CVE-2013-1941

JSON object : View

CWE

CWE-310

Cryptographic Issues

Advertisement

Products Affected

owncloud

owncloud

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://owncloud.org/about/security/advisories/oC-SA-2013-015/", "name": "http://owncloud.org/about/security/advisories/oC-SA-2013-015/", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-310"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-1941", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-06-04T14:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.0.13"}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.0.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:4.5.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:5.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:5.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:5.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:owncloud:owncloud:5.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2014-06-04T18:18Z"}