Flooding logfiles with a 1 Bit BMP File - ownCloud

An Attacker can upload a 1 Bit BMP File and the server hangs and doesn’t stop to populate a logfile

Affected Software

• ownCloud Server < 9.1.3 (CVE-2017-5867)
  • core/0f1da72db6cd3ca08d166d96c57f39b8563d048f
• ownCloud Server < 9.0.7 (CVE-2017-5867)
  • core/69fcf706fc7125c028b87fe8224a544ff124dc4b
• ownCloud Server < 8.2.9 (CVE-2017-5867)
  • core/83da5e2ce952c042abb9ba88c293795b750cde89
• ownCloud Server < 8.1.11 (CVE-2017-5867)
  • core/45fc1aa6f9200fe55e417eed02e18c965fe09872

Action Taken

Suppress error messages with 1 Bit BMP Files

Acknowledgements

The ownCloud team thanks the following people for their research and responsible disclosure of the above advisory:

• Temtaime - Vulnerability discovery and disclosure.