SB2024062768 - Multiple vulnerabilities in BigBlueButton

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Incorrect permission assignment for critical resource (CVE-ID: CVE-2024-39302)

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper file permissions in /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 when accessing files in the directory. A remote attacker can exploit overly elevated file permissions to cause a denial of service.

The issue may be leveraged for privilege escalation and could expose sensitive information on the server.

2) Improper access control (CVE-ID: CVE-2024-38518)

The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.

The vulnerability exists due to improper access control in the join API when handling additional parameters in join requests. A remote user can supply a crafted join link with additional parameters to disclose sensitive information and cause a denial of service.

User interaction is required because the issue involves use of a valid join link to a meeting.

Remediation

Install update from vendor's website.

References

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4