Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2013-6172 First vendor Publication 2013-11-05
Vendor Cve Last vendor Modification 2014-03-26

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6172

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19395
 
Oval ID: oval:org.mitre.oval:def:19395
Title: DSA-2787-1 roundcube - design error
Description: It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitise the _session parameter in steps/utils/save_pref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing random file access, manipulated SQL queries and even code execution.
Family: unix Class: patch
Reference(s): DSA-2787-1
CVE-2013-6172
Version: 5
Platform(s): Debian GNU/Linux 7
Debian GNU/kFreeBSD 7
Product(s): roundcube
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 66

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-210.nasl - Type : ACT_GATHER_INFO
2014-02-12 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201402-15.nasl - Type : ACT_GATHER_INFO
2013-11-11 Name : The remote Fedora host is missing a security update.
File : fedora_2013-19699.nasl - Type : ACT_GATHER_INFO
2013-10-31 Name : The remote Fedora host is missing a security update.
File : fedora_2013-19745.nasl - Type : ACT_GATHER_INFO
2013-10-30 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2013-263.nasl - Type : ACT_GATHER_INFO
2013-10-28 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2787.nasl - Type : ACT_GATHER_INFO
2013-10-27 Name : The remote Fedora host is missing a security update.
File : fedora_2013-19729.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
CONFIRM http://roundcube.net/news/2013/10/21/security-updates-095-and-087/
http://trac.roundcube.net/ticket/1489382
http://www.interworx.com/developers/changelog/version-5-0-13-build-574-2014-0...
DEBIAN http://www.debian.org/security/2013/dsa-2787
SUSE http://lists.opensuse.org/opensuse-updates/2014-03/msg00035.html

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
Date Informations
2020-05-24 01:12:35
  • Multiple Updates
2020-05-23 00:38:36
  • Multiple Updates
2019-07-09 01:05:50
  • Multiple Updates
2018-06-29 12:02:04
  • Multiple Updates
2018-05-19 12:02:06
  • Multiple Updates
2016-04-26 23:44:26
  • Multiple Updates
2014-06-14 13:36:27
  • Multiple Updates
2014-03-26 13:22:51
  • Multiple Updates
2014-03-06 13:23:32
  • Multiple Updates
2014-02-17 11:24:00
  • Multiple Updates
2013-11-06 21:28:41
  • Multiple Updates
2013-11-05 21:25:38
  • First insertion