Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title eGroupWare: Multiple vulnerabilities
Informations
Name GLSA-200805-04 First vendor Publication 2008-05-07
Vendor Gentoo Last vendor Modification 2008-05-07
Severity (Vendor) High Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities in eGroupWare may lead to execution of arbitrary PHP code, the ability to upload malicious files and cross-site scripting attacks.

Background

eGroupWare is a suite of web-based group applications including calendar, address book, messenger and email.

Description

A vulnerability has been reported in FCKEditor due to the way that file uploads are handled in the file editor/filemanager/upload/php/upload.php when a filename has multiple file extensions (CVE-2008-2041). Another vulnerability exists in the
_bad_protocol_once() function in the file phpgwapi/inc/class.kses.inc.php, which allows remote attackers to bypass HTML filtering (CVE-2008-1502).

Impact

The first vulnerability can be exploited to upload malicious files and execute arbitrary PHP code provided that a directory is writable by the webserver. The second vulnerability can be exploited by remote attackers via a specially crafted URL in order to conduct cross-site scripting attacks.

Workaround

There is no known workaround at this time.

Resolution

All eGroupWare users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/egroupware-1.4.004"

References

[ 1 ] CVE-2008-1502 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1502
[ 2 ] CVE-2008-2041 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2041

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200805-04.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200805-04.xml

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-94 Failure to Control Generation of Code ('Code Injection')
50 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17657
 
Oval ID: oval:org.mitre.oval:def:17657
Title: USN-658-1 -- moodle vulnerability
Description: Lukasz Pilorz discovered that the HTML filtering used in Moodle was not strict enough.
Family: unix Class: patch
Reference(s): USN-658-1
CVE-2008-1502
 Version: 7
Platform(s): Ubuntu 7.10
Ubuntu 8.04
 Product(s): moodle
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 10
Application 41

OpenVAS Exploits

Date Description
2009-10-19 Name : Mandrake Security Advisory MDVSA-2009:265 (egroupware)
File : nvt/mdksa_2009_265.nasl
2009-09-02 Name : Debian Security Advisory DSA 1871-1 (wordpress)
File : nvt/deb_1871_1.nasl
2009-09-02 Name : Debian Security Advisory DSA 1871-2 (wordpress)
File : nvt/deb_1871_2.nasl
2009-06-05 Name : Ubuntu USN-698-1 (nagios)
File : nvt/ubuntu_698_1.nasl
2009-03-23 Name : Ubuntu Update for moodle vulnerability USN-658-1
File : nvt/gb_ubuntu_USN_658_1.nasl
2009-02-17 Name : Fedora Update for moodle FEDORA-2008-6226
File : nvt/gb_fedora_2008_6226_moodle_fc8.nasl
2008-12-29 Name : Debian Security Advisory DSA 1691-1 (moodle)
File : nvt/deb_1691_1.nasl
2008-12-29 Name : Ubuntu USN-698-2 (nagios3)
File : nvt/ubuntu_698_2.nasl
2008-12-29 Name : Ubuntu USN-699-1 (blender)
File : nvt/ubuntu_699_1.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-04 (egroupware)
File : nvt/glsa_200805_04.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
44986 eGroupWare Web Server Write Access Unspecified "Grave" Issue
43677 KSES class.kses.inc.php _bad_protocol_once() Function HTML Filter Bypass

Nessus® Vulnerability Scanner

Date Description
2010-02-24 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1871.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-658-1.nasl - Type : ACT_GATHER_INFO
2008-12-22 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1691.nasl - Type : ACT_GATHER_INFO
2008-07-16 Name : The remote openSUSE host is missing a security update.
File : suse_moodle-5439.nasl - Type : ACT_GATHER_INFO
2008-07-10 Name : The remote Fedora host is missing a security update.
File : fedora_2008-6226.nasl - Type : ACT_GATHER_INFO
2008-05-09 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200805-04.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:35:49
  • Multiple Updates