Juraj Somorovsky

BigBlueButton هي منصة للفصول الدراسية الافتراضية. عندما ينضم مستخدم إلى جلسة مع كتم صوت الميكروفون في البداية، يمكن للعميل إرسال بيانات صوتية إلى الخادم، على الرغم من حالة كتم الصوت. وعلى الرغم من أن الخادم يتجاهل هذا الصوت، مما يمنع سماعه من قبل المشاركين الآخرين، إلا أن مشغل الخادم ذو النوايا الخبيثة قد يتمكن من الوصول إلى هذه البيانات. يحدث هذا السلوك فقط في الفترة ما بين دخول المستخدم إلى الاجتماع وحتى أول مرة يقوم فيها بتفعيل الميكروفون.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات خادم Apache HTTP حتى الإصدار 2.4.63 الوصف: في بعض إعدادات mod ssl، يمكن لمهاجم من نوع «man-in-the-middle» اختطاف جلسة HTTP من خلال هجوم ترقية TLS. تؤثر هذه المشكلة على الإعدادات التي تستخدم «SSLEngine optional» لتمكين ترقيات TLS. يرتبط هذا الهجوم بعدم تزامن HTTP. التوصيات: قم بالتحديث إلى الإصدار 2.4.64، الذي يلغي دعم ترقية TLS.

عندما يتم تكوين عدة خوادم لمشاركة نفس عنوان IP والمنفذ، يمكن للمهاجم استخدام استئناف الجلسة لتجاوز متطلبات المصادقة عبر شهادة العميل على هذه الخوادم. تحدث هذه المشكلة عند استخدام تذاكر جلسة TLS و/أو ذاكرة التخزين المؤقت لجلسة SSL على الخادم الافتراضي، وفي حالة قيام الخادم الافتراضي بإجراء المصادقة عبر شهادة العميل.

اسم البرنامج المعرض للثغرة والإصدارات المتأثرة: خادم Apache HTTP من الإصدار 2.4.35 إلى 2.4.63 الوصف: في بعض إعدادات mod ssl، يمكن التحايل على ضوابط الوصول للعملاء الموثوق بهم باستخدام استئناف جلسة TLS 1.3. يحدث هذا عندما يكون mod ssl مُهيأً لعدد من المضيفات الافتراضية، كل منها مقيدة بمجموعة مختلفة من شهادات العملاء الموثوق بهم، ولا يكون `SSLStrictSNIVHostCheck` مُفعَّلاً في أي من المضيفات الافتراضية. التوصيات: إصدارات خادم Apache HTTP من 2.4.35 إلى 2.4.63: قم بتمكين `SSLStrictSNIVHostCheck` في جميع تكوينات المضيفات الافتراضية.

The issue is related to an easily exploitable vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via DTLS to compromise the system, resulting in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security.

The moderators-only webcams lock setting in BigBlueButton is not enforced on the backend. This allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied, by exploiting the fact that the required `streamId` is sent to all users, regardless of the lock setting.

BigBlueButton is an open source web conferencing system. The issue concerns Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. However, moderators should only be able to set none as the status of other users.

BigBlueButton is an open source web conferencing system. The system contains a whiteboard grace period to handle delayed messages, but this period can be exploited by attackers to perform actions in the few seconds after their access is revoked. The attacker must be a meeting participant.

The issue affects BigBlueButton, an open source web conferencing system, and allows an attacker who is a meeting presenter to start a subscription for poll results before starting an anonymous poll. This subscription can then be used to see individual responses in the anonymous poll.

The issue concerns ineffective user bans in BigBlueButton, an open source web conferencing system. An attacker could register multiple users and join a meeting with one of them. If that user is banned, they could still join the meeting with the remaining registered users from the same extId. This is resolved by improving permissions so that banning a user removes all related users, including those who have not joined the meeting.

The issue affects meetings with polls in BigBlueButton, an open source web conferencing system, where an attacker who is a meeting participant can gain access to sensitive information. Specifically, subscribing to the current-poll collection does not update the client UI but gives the attacker access to the contents of the collection, including individual poll responses.

The issue is related to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's `userId`, `meetingId`, and an invalid `authToken`. This forces the victim to leave the conference because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server.

An insufficient entropy issue, caused by the improper use of randomness sources with low entropy for RSA key pair generation, affects the web administration interface. This could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate.

BigBlueButton is an open source web conferencing system. An attacker, who needs to be a participant in the meeting, could send messages to a locked chat within a 5-second grace period after the lock setting was changed.

BigBlueButton is an open source web conferencing system. An attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched by modifying the stream to send the data only for users in the meeting.

BigBlueButton is an open source web conferencing system. An attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server, provided they are a participant in a meeting on the server.

BigBlueButton is an open source web conferencing system. An attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user.

BigBlueButton is an open source web conferencing system. An attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant.

A S/MIME issue existed in the handling of encrypted email, allowing an attacker to potentially recover plaintext contents of an S/MIME-encrypted email. This issue was addressed by not automatically loading some MIME parts.

The issue is related to errors in privilege management within the Windows HTML Platform component of the Windows operating system. This can allow a remote attacker to bypass existing security restrictions.