zoneminder: CVE-2016-10140

Debian Bug report logs - #851710
zoneminder: CVE-2016-10140

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: zoneminder: CVE-2016-10140

Date: Tue, 17 Jan 2017 21:37:46 +0100

Source: zoneminder
Version: 1.30.0+dfsg-2
Severity: important
Tags: security upstream patch

Hi,

the following vulnerability was published for zoneminder.

CVE-2016-10140[0]:
| Information disclosure and authentication bypass vulnerability exists
| in the Apache HTTP Server configuration bundled with ZoneMinder
| v1.30.0, which allows a remote unauthenticated attacker to browse all
| directories in the web root, e.g., a remote unauthenticated attacker
| can view all CCTV images on the server.

The package then installs respectively
/etc/apache2/conf-available/zoneminder.conf with the problematic
settings.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-10140
[1] https://github.com/ZoneMinder/ZoneMinder/pull/1697
[2] https://github.com/ZoneMinder/ZoneMinder/commit/6361f143878ce00659f64ce42593951d773e4e63
[3] https://github.com/ZoneMinder/ZoneMinder/commit/aa0a4d1f5ad2c493f2bed175991e92c466ac3dc4

Regards,
Salvatore

Message #10 received at 851710@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 851710@bugs.debian.org

Cc: Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#851710: zoneminder: CVE-2016-10140

Date: Wed, 18 Jan 2017 06:14:01 +0100

Control: severity -1 grave

On Tue, Jan 17, 2017 at 09:37:46PM +0100, Salvatore Bonaccorso wrote:
> Source: zoneminder
> Version: 1.30.0+dfsg-2
> Severity: important
> Tags: security upstream patch
> 
> Hi,
> 
> the following vulnerability was published for zoneminder.
> 
> CVE-2016-10140[0]:
> | Information disclosure and authentication bypass vulnerability exists
> | in the Apache HTTP Server configuration bundled with ZoneMinder
> | v1.30.0, which allows a remote unauthenticated attacker to browse all
> | directories in the web root, e.g., a remote unauthenticated attacker
> | can view all CCTV images on the server.
> 
> The package then installs respectively
> /etc/apache2/conf-available/zoneminder.conf with the problematic
> settings.

After discussing with Moritz Muehlenhoff (jmm), decided to raise the
severity to RC, and have the conffile fix included in stretch.

Regards,
Salvatore

Message #17 received at 851710-submitter@bugs.debian.org (full text, mbox, reply):

From: Dmitry Smirnov <onlyjob@member.fsf.org>

To: 851710-submitter@bugs.debian.org

Subject: Bug#851710 tagged as pending

Date: Sat, 18 Feb 2017 04:04:49 +0000

tag 851710 pending
--

We believe that the bug #851710 you reported has been fixed in the Git
repository. You can see the commit message below and/or inspect the
commit contents at:

    http://anonscm.debian.org/cgit/collab-maint/zoneminder.git/diff/?id=7314d05

(This message was generated automatically by
 'git-post-receive-tag-pending-commitmsg' hook).
---
commit 7314d05 (HEAD, master)
Author: Dmitry Smirnov <onlyjob@member.fsf.org>
Date:   Sat Feb 18 04:03:24 2017

    CVE-2016-10140: forbid directory listing in Apache config (Closes: #851710).

Message #22 received at 851710-done@bugs.debian.org (full text, mbox, reply):

From: Chris Lamb <lamby@debian.org>

To: 851710-done@bugs.debian.org

Cc: Salvatore Bonaccorso <carnil@debian.org>

Subject: Re: zoneminder: CVE-2016-10140

Date: Sun, 06 Aug 2017 20:40:09 -0400

Version: 1.30.4+dfsg-1

Hi,

| Information disclosure and authentication bypass vulnerability exists
| in the Apache HTTP Server configuration bundled with ZoneMinder
| v1.30.0, which allows a remote unauthenticated attacker to browse all
| directories in the web root, e.g., a remote unauthenticated attacker
| can view all CCTV images on the server.

Fix included in 1.30.4+dfsg-1 via upstream.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb, Debian Project Leader
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #27 received at 851710@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Chris Lamb <lamby@debian.org>

Cc: 851710@bugs.debian.org

Subject: Re: zoneminder: CVE-2016-10140

Date: Mon, 7 Aug 2017 07:10:55 +0200

Hi Chris,

On Sun, Aug 06, 2017 at 08:40:09PM -0400, Chris Lamb wrote:
> Version: 1.30.4+dfsg-1
> 
> Hi,
> 
> | Information disclosure and authentication bypass vulnerability exists
> | in the Apache HTTP Server configuration bundled with ZoneMinder
> | v1.30.0, which allows a remote unauthenticated attacker to browse all
> | directories in the web root, e.g., a remote unauthenticated attacker
> | can view all CCTV images on the server.
> 
> Fix included in 1.30.4+dfsg-1 via upstream.

Thanks for the update!

I think I did already update that entry, let me check.

Regards,
Salvatore

Send a report that this bug log contains spam.