Jump to content


Photo

[Security] CVE-2017-9807 - OpenWebIf Vulnerability

Started by WanWizard, 24 Jun 2017 10:38
security OpenWebIf

  • This topic is locked This topic is locked
4 replies to this topic

#1 WanWizard

  • Forum Moderator
    PLi® Core member
  • 54,926 posts

+1,094
Excellent

Posted 24 June 2017 - 10:38

Attention
 
With the CVE number mentioned above a serious vulnerability in relation to the OpenWebIf has been reported. See https://cve.mitre.or...e=CVE-2017-9807 for details.
 
The vulnerability makes it possible to create, overwrite or change arbitrary files using a specially formulated web request. Every Enigma2 version with an installed OpenWebIf is impacted.
 
For those who still have their box open, connected to the internet without the use of a VPN: Please switch this off immediately, before your box is hacked!!!
 
The OpenWebIf team is working very hard to find a solution for this problem.

Currently in use: VU+Duo 4K (2xFBC S2), Amiko Viper T2C (T2+fallback), Octagon SF8008 (S2+T2), Zgemma H9.2H (T2+fallback)

Many answers to your question can be found in our new and improved wiki.

note: I do not provide support via PM !

 

Re: [Security] CVE-2017-9807 - OpenWebIf Vulnerability #2 Dream1975

  • Senior Member
  • 1,604 posts

+14
Neutral

Posted 24 June 2017 - 12:43

If the box is somewhere else, but you can reach it through Putty, you can use "opkg remove enigma2-plugin-extensions-openwebif" to (temporary) remove Openwebif


Edited by Dream1975, 24 June 2017 - 12:43.

Mutant HD2400, OpenPLi RC, 2x DVB-C & 2x DVB-S

Mutant HD51, OpenPLi RC, 1x DVB-C & 1x DVB-S

Wavefrontier T55 (Astra 1,2,3 en HB)

Smartcards Ziggo (Irdeto) and CDS (Seca) on Oscam

 

Re: [Security] CVE-2017-9807 - OpenWebIf Vulnerability #3 theparasol

  • Senior Member
  • 4,141 posts

+196
Excellent

Posted 24 June 2017 - 15:28

Fix has been committed https://github.com/E...24fb8d7dd610f46


Re: [Security] CVE-2017-9807 - OpenWebIf Vulnerability #4 WanWizard

  • Forum Moderator
    PLi® Core member
  • 54,926 posts

+1,094
Excellent

Posted 24 June 2017 - 15:46

Will be part of tomorrows images.


Currently in use: VU+Duo 4K (2xFBC S2), Amiko Viper T2C (T2+fallback), Octagon SF8008 (S2+T2), Zgemma H9.2H (T2+fallback)

Many answers to your question can be found in our new and improved wiki.

note: I do not provide support via PM !

 

Re: [Security] CVE-2017-9807 - OpenWebIf Vulnerability #5 WanWizard

  • Forum Moderator
    PLi® Core member
  • 54,926 posts

+1,094
Excellent

Posted 25 June 2017 - 11:02

Topic can be closed.

 

Thanks to Jörg Bleyel for the quick fix for this issue!


Currently in use: VU+Duo 4K (2xFBC S2), Amiko Viper T2C (T2+fallback), Octagon SF8008 (S2+T2), Zgemma H9.2H (T2+fallback)

Many answers to your question can be found in our new and improved wiki.

note: I do not provide support via PM !

 

Back to [EN] Enduser support



Also tagged with one or more of these keywords: security, OpenWebIf

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Forums
  2. → PLi® Support
  3. → [EN] Enduser support