Correction: BMC-2015-0005: File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting

2015-10-26T00:00:00
ID SECURITYVULNS:DOC:32620
Type securityvulns
Reporter Securityvulns
Modified 2015-10-26T00:00:00

Description

Enigmail: ????? ????? ????????? ?? ???? ??????????? ??? ?????????

Errata: This is a correction of our previous disclosure email from September 23rd, 2015. Our previous posting implied that the security vulnerability we discovered was in the "BIRT Viewer" servlet itself. This is NOT the case, but rather the vulnerability is in how the "BIRT Viewer" was configured when embedded within the Remedy AR Reporting engine.


File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting

BMC Identifier: BMC-2015-0005 CVE Identifier: CVE-2015-5071


By BMC Application Security, SEP 2015


Vulnerability summary

A security vulnerability has been identified in BMC Remedy AR Reporting.

The vulnerability can be exploited remotely allowing navigation to any local or remote file.


CVSS v2.0 Base Metrics

Reference:
CVE-2015-5071

Base Vector:
(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Base Score: 4.0


Affected versions

The flaw has been confirmed to exist in BMC Remedy AR 8.1 and 9.0. Earlier Versions may also be affected


Resolution

A hotfix as well as a workaround are available at

https://kb.bmc.com/infocenter/index?page=content&id=KA429507


Credits

Credit for discovery of this vulnerability: Stephan Tigges from tigges-security.de


Reference

CVE-2015-5071

Information about BMC's corporate procedure for external vulnerability disclosures is at http://www.bmc.com/security

* ????????? ????? ????????? ??????????? ??? ???????? ???????? ???????? *

-----BEGIN PGP UNVERIFIED MESSAGE----- Errata: This is a correction of our previous disclosure email from September 23rd, 2015. Our previous posting implied that the security vulnerability we discovered was in the "BIRT Viewer" servlet itself. This is NOT the case, but rather the vulnerability is in how the "BIRT Viewer" was configured when embedded within the Remedy AR Reporting engine.


File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting

BMC Identifier: BMC-2015-0005 CVE Identifier: CVE-2015-5071


By BMC Application Security, SEP 2015


Vulnerability summary

A security vulnerability has been identified in BMC Remedy AR Reporting.

The vulnerability can be exploited remotely allowing navigation to any local or remote file.


CVSS v2.0 Base Metrics

Reference:
CVE-2015-5071

Base Vector:
(AV:N/AC:L/Au:S/C:P/I:N/A:N)

Base Score: 4.0


Affected versions

The flaw has been confirmed to exist in BMC Remedy AR 8.1 and 9.0. Earlier Versions may also be affected


Resolution

A hotfix as well as a workaround are available at

https://kb.bmc.com/infocenter/index?page=content&id=KA429507


Credits

Credit for discovery of this vulnerability: Stephan Tigges from tigges-security.de


Reference

CVE-2015-5071

Information about BMC's corporate procedure for external vulnerability disclosures is at http://www.bmc.com/security-----END PGP UNVERIFIED MESSAGE-----

-----BEGIN PGP MESSAGE----- Version: GnuPG v2

owGtVl1sFFUUbkVadnErfSCm2sTbxiiadnfbUoHld7tpSdEW7K4bwwN6d/bOzqUz c4c7d/bHBDEqEjElTSCm2iYWIyYqJsqD1QS0iSb+NBEfKMRogjzQaoQYQGhNNXru bH/YUHkws9nszs+995zvnO985/QHlpQtK/+w8rORa1PTR8rHfkuVJav+GG7nHAsc CfgTGrURfDFSGOdEEZSZiKmIORxZnGQpc2yUpraiM9vhBBEDUx2pnBkoTixBjBTh qLmFpxtQc7ipNRjwb795p8VsQc0MooalU5JGQsMCfgiyieJwKgoo6+gm4ThFdXmX I64xliUcVucw+Ga66+vbOnsSKElJjvB62M2zOhGICpvoanABRvf2hLtcwTZpQClH IMCpgYvyYakp6p6tsdwi50vDCjNVmnFcPzRiIgk1nZZ3VGizXvUQg6QLKNoDVxbj LlRiZqhJwKeAv9GjT8DfQXUC7iq6Y8sElSJRsGODX6kCMmTsim7juUwuHjkA6G4C IG1dscWABPwo4JfvOtPEFFSlhEfk2kaZ58ZwONwa8MeS7SWv4b74ujW8pslL/G0F 182oBTRSitDiswxqQPH2HS75XI+9s5ksCbLtGAbmBS8NRP+rCjTITooA5+hcbG+X qKCLO3ELwRVswimI5C2dUQFHcGIwQfQCwrrOcpKrJs7STDGcgiFsFpDOFKwjxmcX IxWI5zGXY8l4HGWbg2HUBlWKuojgVLG9tNBDVNAPUyERn8vRmzkJXJJWkyB1jEd8 8hPwr4omI92haCzyeCjqROKhWGRHqFM+iXQ/jHzzm+KgkQREc3Uw7G1IoqoK/kCK QPdkgXsaDckMVce5BVq5GsENqccM+EFtcSu91gabgBBptC4YDgK92jEHAecQt6KD yMCSRzaTFMOz7ntcgD3EZroj2elt1WlMqDQvJTBHdF3+Y5RjvBdz5gBiDG0OZ6HN 4RSILhYuKk0Iy46EQr2pYMpQggozQtRUmQL1SThcpkl+s4UzZCPEVsDDB2l642PR 1c3rgHUehyUGLQka3/88cvT72xyKVKj8uQZckN1DyMZaoisRFBfE0kBcEjSTIXZx GBDudeOcoAXTxNsKmS9pb5WoRBogS52QU24UFRGnGMwPUBUPyWGAg9piEESLQ9LT chSSsSJ5SL8JilkqvQsDU3G4EkjyB+iTy+Xm+TMXq1fKa+8sK19WVrH0Djmalfl9 K+bmtcpLlX/XXD778eZfp8atTV+vf/Tt6OH6+7SD08vReHKr1fZP38y+mhhe8bmz b7Isf6ql+sfmUyd2PlB3dejuqsKWJZ2T4rgyeWX5kaN7jl2Ywf17Pynw4f1btefw 9RtPTo9Wf9OnqfTpZ34a6K8des1ceXFnQ4P95eCa6OHkR+ef3/XqhqqGGxcnaw6s P7/trqmJex/ZPXgl+sSJgauf1isvaC93vH/8hxd/EResserBk11r79l2SHljwyHf 75d3V1QfuNRy9iut4qX7ExP52Mh3b53sGLr+xbWx02eG2dFVfx1b2pt809eXPzh+ bvRM3f5MU8XPtROtozO73n1n5bPvVW2pe33kqT+Hzw2c/mDvpm/3/As= =tfHh -----END PGP MESSAGE-----

* ????? ?????????? ????? ?????????* **