Secure testing team - Aug 2012 - Bug#684426: [owncloud] Users can overwrite read-only shared files owned by other users via WebDAV

Package: owncloud
Version: 4.0.5debian2-1
Severity: grave
Tags: patch security
X-Debbugs-CC: secure-testing-team at lists.alioth.debian.org

--- Please enter the report below this line. ---
Hi,

I stumbled over a security bug in owncloud with the result of data loss
or modification, depending on the configuration of owncloud.

It is possible for regular users of owncloud to overwrite files that are
shared by another owncloud user via WebDAV.

If version control is activated user1 could revert the file to its
previous state, but if it''s not activated, user1''s data is
lost.

Find attached a patch that should fix the security flaw for owncloud
4.0.5debian2-1.

Cheers - Fuddl

--- System information. ---
Architecture: amd64
Kernel:       Linux 3.2.0-3-amd64

Debian Release: wheezy/sid
  500 unstable        ftp.de.debian.org 
    1 experimental    ftp.de.debian.org 

--- Package information. ---
Package''s Depends field is empty.

Package''s Recommends field is empty.

Package''s Suggests field is empty.



-------------- next part --------------
A non-text attachment was scrubbed...
Name: fix-webdav-security.diff
Type: text/x-patch
Size: 1826 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20120809/6b6318a9/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20120809/6b6318a9/attachment.pgp>