Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 439
Alerts This Week
Warning Icon 1 439

Ubuntu 22.04 LTS USN-6914-1 Security Alert: Ocsinventory-Server Auth Bypass

ubuntu
Calendar Grey July 24, 2024
Scroller Ubuntu
Ubuntu Security Notice USN-6915-1 describes a severe vulnerability in ocsinventory-server that could enable unauthorized access to accounts.
OCS Inventory was vulnerable to an authentication bypass if the selected authentication method was via CAS.

Summary

OCS Inventory was vulnerable to an authentication bypass if the

selected authentication method was via CAS.

Software Description:

- ocsinventory-server: Hardware and software inventory tool

Details:

Filip Hejsek discovered that the phpCAS library included in OCS Inventory

was using HTTP headers to determine the service URL used to validate

tickets. A remote attacker could possibly use this issue to gain access

to a victim's account.

Topics%20covered

Topics Covered

security advisory critical remote access Ubuntu update instructions authentication bypass ocsinventory-server

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
ocsinventory-reports 2.8.1+dfsg1-1ubuntu0.1
ocsinventory-server 2.8.1+dfsg1-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6914-1

CVE-2022-39369

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6914-1

Topics%20covered

Topics Covered

security advisory critical remote access Ubuntu update instructions authentication bypass ocsinventory-server

Package Information

https://launchpad.net/ubuntu/+source/ocsinventory-server/2.8.1+dfsg1-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.