CVE-2014-9465: Race Condition
I discovered a flaw in Zarafa WebAccess >= 7.0.0 and Zarafa WebApp (any version) that could allow a remote unauthenticated attacker to exhaust the disk space of /tmp. Depending on the setup /tmp might be on / (e.g. RHEL). Zarafa WebApp is a fork and the successor of the Zarafa WebAccess.
The affected files are /usr/share/zarafa-webaccess/senddocument.php as well as /usr/share/zarafa-webapp/senddocument.php. The default upload size is 30 MB (via /etc/httpd/conf.d/zarafa-webaccess.conf / zarafa-webapp.conf).
I do not know if $tmpname is predictable (for race conditions) but likely not. The 2nd parameter is only a prefix according to the PHP documentation of tempnam().
From my point of view the file "senddocument.php" is neither referenced nor used anywhere in the code and could be simply removed.
Upstream has been notified and I am awaiting their response. At the moment this RHBZ is only meant to have this tracked somewhere, please do not yet disclose.
Other sources
senddocument.php in Zarafa WebApp before 2.0 beta 3 and WebAccess in Zarafa Collaboration Platform (ZCP) 7.x before 7.1.12 beta 1 and 7.2.x before 7.2.0 beta 1 allows remote attackers to cause a denial of service (/tmp disk consumption) by uploading a large number of files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9465?
CVE-2014-9465 is classified as a medium severity vulnerability that can lead to denial of service through disk space exhaustion.
How do I fix CVE-2014-9465?
To fix CVE-2014-9465, you should update Zarafa WebAccess or Zarafa WebApp to the latest version that addresses this vulnerability.
Who is affected by CVE-2014-9465?
CVE-2014-9465 affects users running Zarafa WebAccess versions greater than 7.0.0 and any versions of Zarafa WebApp.
Can CVE-2014-9465 be exploited remotely?
Yes, CVE-2014-9465 can be exploited remotely by unauthenticated attackers to exhaust disk space.
What systems are most at risk from CVE-2014-9465?
Systems where the /tmp directory is on the root filesystem, such as RHEL, are at higher risk from CVE-2014-9465.