VU#449452

	A	B	C	D	E
1	CVE ID	Zenoss Bug ID	Summary	Impact Description	Vendor Status
2				Provided by Matasano Security	Provided by Zenoss
3	CVE-2014-6253	ZEN-12653	Systemic Cross Site Request Forgery	An attacker could utilize a cross site request forgery to force a user to perform actions without their knowing. If an attacker were able to coerce a user to visit a malicious page, the attacker could embed malicious content that automatically performs a POST or GET request on behalf of the authenticated user, performing an arbitrary action. Furthermore, if the site contains multiple cross site scripting vulnerabilities, an attacker could utilize these vulnerabilities to force a user to perform an action simply by passively viewing content on the control center site.	BACKLOG: We are internally tracking this as ZEN-12653. It has been assigned priority 3 for our next maintenance release on the Zenoss 5 line.
4	CVE-2014-6254	ZEN-15381	Systemic Stored Cross-Site Scripting in Zenoss Attributes	Attackers can cause authenticated users of the application to perform action on behalf of the attacker, and to send data from the application to the attacker. In pages that display device names and details, report names or details, portlet names, and other information from Zenoss, data from the browser is integrated into pages without validation or encoding. This allows attackers to create links and form submissions that result in code of the attacker's choosing being integrated into the resulting pages. If an attacker can convince another user to click their link, or view any web page on the internet that the attacker can partially control, the user's browser will execute the attacker's JavaScript in the context of the target site.	BACKLOG: We are internally tracking this as ZEN-15381. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
5	CVE-2014-9245	ZEN-15382	Stack Trace Contains Internal URLs and Other Sensitive Information	Attempting to rename a product to a name containing special characters fails, and an error page containing a stack trace is returned. An attacker may be able to use this information to plan further attacks, or in a social engineering attack.	BACKLOG: We are internally tracking this as ZEN-15382. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
6	CVE-2014-6255	ZEN-11998	Open Redirect in Login Form	An open redirect is an endpoint in the application which accepts a GET request with an arbitrary URL embedded in the path or query string, and issues a HTTP redirect to the specified URL. This allows attackers to craft a link which appears to lead to the application, but results in a page controlled by the attacker. The login form accepts an arbitrary URL in the `came_from` query parameter, and redirects the user to this url after a successful login.	CLOSED: We are internally tracking this as ZEN-11998. It has been resolved in Zenoss 4.2.5 SP161.
7	CVE-2014-6261	ZEN-12657	Remote Code Execution via Version Check	An attacker who is able to get a victim to visit an attacker-controlled website while logged in to the Zenoss interface can execute arbitrary code on the Zenoss installation. Additionally, an attacker who is able to perform a man-in-the-middle attack between the Zenoss installation and Zenoss' corporate "callhome" server - or control the "callhome" server - can execute arbitrary code on the Zenoss installation.	BACKLOG: We are internally tracking this as ZEN-12657. It has been assigned priority 3 for our next maintenance release on the Zenoss 5 line.
8	CVE-2014-6256	ZEN-15386	Authorization Bypass Allows Moving Arbitrary Files	An attacker may be able to move files containing sensitive data to a publicly accessible directory, or place files containing attacker-controlled content into a location where they will be executed.	BACKLOG: We are internally tracking this as ZEN-15386. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
9	CVE-2014-9246	ZEN-15388	Cross-Site Request Forgery Leads to ZenPack Installation	The Zenoss user interface allows qualified users to upload ZenPacks, which will then be unpacked and installed. These ZenPacks will be loaded by Zenoss after it is restarted. Because there is no cross-site request forgery protection, an attacker may exploit this ability to run code on the Zenoss server when it is restarted.	BACKLOG: We are internally tracking this as ZEN-15388. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
10	CVE-2014-9246	ZEN-12691	Sessions Do Not Expire	An attacker on a shared computer setup (such as a library or kiosk) could visit the Zenoss dashboard, write down the associated session ID cookie, and enter it on their computer as well. When a user logs in to Zenoss, the attacker will then be logged in as the user.	CLOSED: We are internally tracking this as ZEN-12691. It has been resolved in the latest Zenoss 4.2.5 SP.
11	CVE-2014-9247	ZEN-15389	User Enumeration via User Manager	Even as an unprivileged user, the ZenUsers page lists the users in the system, their email addresses, and their roles.	BACKLOG: We are internally tracking this as ZEN-15389. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
12	CVE-2014-9248	ZEN-15406	No Password Complexity Requirements	A user may choose a bad password that makes it easy for an attacker to guess their password and log in to their account. The application does not enforce any password complexity requirements.	BACKLOG: We are internally tracking this as ZEN-15406. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
13	CVE-2014-6257	ZEN-15407	Systemic Authorization Bypasses	An attacker may be able to trigger actions that were not intended to be triggered, or may be able to trigger actions that would normally require more permissions than their account has. The Zope platform on which Zenoss runs maps URLs to a tree of objects, with the final path component as a method call on the specified object. Methods can be protected with the `ZEN_CHANGE_SETTINGS` permission, however the default state for object methods is to be accessible. Many helper methods not intended to be directly invoked as web endpoints are not protected, and can be invoked by any user who has access to view the underlying object.	BACKLOG: We are internally tracking this as ZEN-15407. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
14	CVE-2014-9249	ZEN-15408	Exposed Services in Default Configuration	An attacker may be able to read or modify system information from any of the available databases, use write access to one of the servers to inject information that may exploit the trusted position of those databases in Zenoss, or exploit a vulnerability in any of the other pieces of software. This is due to unnecessarily exposed open ports.	CLOSED: We are internally tracking this as ZEN-15408. We will not be addressing this in the Zenoss 4 line, and it has been resolved in the Zenoss 5 line.
15	CVE-2014-9250	ZEN-10148	Cookie Authentication is Insecure	An attacker able to retrieve the authentication cookie (which does not have the HttpOnly flag set) would be able to determine the user's username and password.	CLOSED: We are internally tracking this as ZEN-10148. We are not planning a product change for this issue. We recommend that users wanting to use cookie-based authentication configure their Zenoss installation to operate over SSL/HTTPs.
16	CVE-2014-6254	ZEN-15410	Cross Site Scripting from Exposed Helper Methods	Many "helper" methods on internal objects are exposed to direct invocation via HTTP requests. Various methods which perform string manipulations can be used to perform both stored and reflected cross-site scripting (XSS) attacks. (Additionally, see Issue #11)	BACKLOG: We are internally tracking this as ZEN-15410. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
17	CVE-2014-6258	ZEN-15411	Denial of Service from User-Supplied Regular Expression	A publicly accessible endpoint on the server allows a client to specify a regex and a string to match it against. An attacker can craft a match which requires exponential time to complete, preventing the server from responding to other requests.	BACKLOG: We are internally tracking this as ZEN-15411. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
18	CVE-2014-6260	ZEN-15412	Page Command can be Edited Without Password Re-Entry	An attacker who is able to gain access to an administrator's session (either via an unlocked computer or other means of attack) would be able to change the pager command, leading to users not receiving pages, or arbitrary command execution. The command used to send a page to users can be edited by users with sufficient permission, without re-entering their password. Where commands are entered elsewhere in the system, editing a command requires a user's password, to avoid an attacker using a logged-in session of an administrator to change commands.	BACKLOG: We are internally tracking this as ZEN-15412. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
19	CVE-2014-9251	ZEN-15413	Weak Password Hashing Algorithm	An attacker who is able to get a copy of the Zenoss database may be able to brute-force passwords.	BACKLOG: We are internally tracking this as ZEN-15413. It has been assigned priority 3 for our next maintenance release on the Zenoss 5 line.
20	CVE-2014-6259	ZEN-15414	Denial of Service Via XML Recursive Entity Expansion ("Billion Laughs")	An attacker can cause the server to consume arbitrarily large amounts of memory and CPU resources, causing a denial of service.	BACKLOG: We are internally tracking this as ZEN-15414. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
21	CVE-2014-6262	ZEN-15415	Denial of Service via RRDtool Format String Vulnerability	The Zenoss user interface may be unavailable if an ongoing attack using these vulnerabilities is being executed. If the CVE-2013-2131 vulnerability is exploited, remote code execution may result. A pair of format string vulnerabilities in RRDtool may lead to unwanted behavior. Denial of service attack is confirmed, but more sophisticated attacks could potentially lead to code execution.	CLOSED: We are internally tracking this as ZEN-15415. We will not be addressing this in the Zenoss 4 line, and it has been resolved in the Zenoss 5 line.
22	CVE-2014-9252	ZEN-15416	Plaintext Password Stored in Session on Server	An attacker who is able to gain access to the session database can obtain plaintext copies of user passwords. The attacker may then use those passwords to authenticate to Zenoss, or to attempt attacks on other services where credential reuse is a possibility.	BACKLOG: We are internally tracking this as ZEN-15416. It has been assigned priority 2 for our next maintenance release on the Zenoss 5 line.
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100