what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Senderek Web Security

ownCloud 7.0.0 Private RSA Key Disclosure

Posted Aug 4, 2014

Authored by Senderek Web Security

In consequence of an insufficient threat model, ownCloud is storing all user's private RSA keys in clear text in PHP session files. These unencrypted private keys can be accessed by every web application that has the privilege of the web server user. The affected files exposing cryptographic keys will be stored in the PHP session directory for a number of hours until they are removed. All versions of ownCloud since the introduction of the encryption module in version 5.0.7 including version 7.0.0 are affected.

tags | advisory, web, php, info disclosure

SHA-256 | a618a09a68105380a438f404228d67b0045ecb744d155c0bdce6d9697cc0177d

Download | Favorite | View