6.4 - GLSA-200909-14

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	Horde: Multiple vulnerabilities

Informations
Name	GLSA-200909-14	First vendor Publication	2009-09-12
Vendor	Gentoo	Last vendor Modification	2009-09-12
Severity (Vendor)	Normal	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N)
Cvss Base Score	6.4	Attack Range	Network
Cvss Impact Score	4.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been discovered in Horde and two modules, allowing for the execution of arbitrary code, information disclosure, or Cross-Site Scripting.

Background

Horde is a web application framework written in PHP. Horde IMP, the
"Internet Messaging Program", is a Webmail module and Horde Passwd is a password changing module for Horde.

Description

Multiple vulnerabilities have been discovered in Horde:

* Gunnar Wrobel reported an input sanitation and directory traversal flaw in framework/Image/Image.php, related to the "Horde_Image driver name" (CVE-2009-0932).

* Gunnar Wrobel reported that data sent to horde/services/portal/cloud_search.php is not properly sanitized before used in the output (CVE-2009-0931).

* It was reported that data sent to framework/Text_Filter/Filter/xss.php is not properly sanitized before used in the output (CVE-2008-5917).

Horde Passwd: David Wharton reported that data sent via the "backend"
parameter to passwd/main.php is not properly sanitized before used in the output (CVE-2009-2360).

Horde IMP: Gunnar Wrobel reported that data sent to smime.php, pgp.php, and message.php is not properly sanitized before used in the output
(CVE-2009-0930).

Impact

A remote authenticated attacker could exploit these vulnerabilities to execute arbitrary PHP files on the server, or disclose the content of arbitrary files, both only if the file is readable to the web server. A remote authenticated attacker could conduct Cross-Site Scripting attacks. NOTE: Some Cross-Site Scripting vectors are limited to the usage of Microsoft Internet Explorer.

Workaround

There is no known workaround at this time.

Resolution

All Horde users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose =www-apps/horde-3.3.4

All Horde IMP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose =www-apps/horde-imp-4.3.4

All Horde Passwd users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose =www-apps/horde-passwd-3.1.1

References

[ 1 ] CVE-2008-5917 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5917
[ 2 ] CVE-2009-0930 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0930
[ 3 ] CVE-2009-0931 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0931
[ 4 ] CVE-2009-0932 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0932
[ 5 ] CVE-2009-2360 : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2360

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200909-14.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-200909-14.xml

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-251	Local Code Inclusion
CAPEC-252	PHP Local File Inclusion

CWE : Common Weakness Enumeration

%	Id	Name
80 %	CWE-79	Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)
20 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13021

Oval ID:	oval:org.mitre.oval:def:13021
Title:	DSA-1829-1 sork-passwd-h3 -- insufficient input sanitising
Description:	It was discovered that sork-passwd-h3, a Horde3 module for users to change their password, is prone to a cross-site scripting attack via the backend parameter. For the oldstable distribution, this problem has been fixed in version 3.0-2+etch1. For the stable distribution, this problem has been fixed in version 3.0-2+lenny1. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 3.1-1.1. We recommend that you upgrade your sork-passwd-h3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1829-1 CVE-2009-2360	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	sork-passwd-h3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Installed architecture is all AND sork-passwd-h3 DPKG is earlier than 3.0-2+lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND sork-passwd-h3 DPKG is earlier than 3.0-2+etch1

Definition Id: oval:org.mitre.oval:def:13528

Oval ID:	oval:org.mitre.oval:def:13528
Title:	DSA-1770-1 imp4 -- Insufficient input sanitising
Description:	Several vulnerabilities have been found in imp4, a webmail component for the horde framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-4182 It was discovered that imp4 suffers from a cross-site scripting attack via the user field in an IMAP session, which allows attackers to inject arbitrary HTML code. CVE-2009-0930 It was discovered that imp4 is prone to several cross-site scripting attacks via several vectors in the mail code allowing attackers to inject arbitrary HTML code. For the oldstable distribution, these problems have been fixed in version 4.1.3-4etch1. For the stable distribution, these problems have been fixed in version 4.2-4, which was already included in the lenny release. For the testing distribution and the unstable distribution, these problems have been fixed in version 4.2-4. We recommend that you upgrade your imp4 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1770-1 CVE-2008-4182 CVE-2009-0930	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	imp4
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND imp4 DPKG is earlier than 4.1.3-4etch1

Definition Id: oval:org.mitre.oval:def:13562

Oval ID:	oval:org.mitre.oval:def:13562
Title:	DSA-1765-1 horde3 -- Multiple vulnerabilities
Description:	Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0932 Gunnar Wrobel discovered a directory traversal vulnerability, which allows attackers to include and execute arbitrary local files via the driver parameter in Horde_Image. CVE-2008-3330 It was discovered that an attacker could perform a cross-site scripting attack via the contact name, which allows attackers to inject arbitrary html code. This requires that the attacker has access to create contacts. CVE-2008-5917 It was discovered that the horde XSS filter is prone to a cross-site scripting attack, which allows attackers to inject arbitrary html code. This is only exploitable when Internet Explorer is used. For the oldstable distribution, these problems have been fixed in version 3.1.3-4etch5. For the stable distribution, these problems have been fixed in version 3.2.2+debian0-2, which was already included in the lenny release. For the testing distribution and the unstable distribution , these problems have been fixed in version 3.2.2+debian0-2. We recommend that you upgrade your horde3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1765-1 CVE-2009-0932 CVE-2008-3330 CVE-2008-5917	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	horde3
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND horde3 DPKG is earlier than 3.1.3-4etch5

Definition Id: oval:org.mitre.oval:def:13657

Oval ID:	oval:org.mitre.oval:def:13657
Title:	DSA-1829-2 sork-passwd-h3 -- insufficient input sanitising
Description:	The previous update introduced a regression in main.php, causing the module to fail. This update corrects the flaw. For reference the original advisory text is below. It was discovered that sork-passwd-h3, a Horde3 module for users to change their password, is prone to a cross-site scripting attack via the backend parameter. For the oldstable distribution, this problem has been fixed in version 3.0-2+etch2. For the stable distribution, this problem has been fixed in version 3.0-2+lenny2. For the testing distribution, this problem will be fixed soon. For the unstable distribution, this problem has been fixed in version 3.1-1.2. We recommend that you upgrade your sork-passwd-h3 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1829-2 CVE-2009-2360	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	sork-passwd-h3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Installed architecture is all AND sork-passwd-h3 DPKG is earlier than 3.0-2+lenny2 OR Release section Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND sork-passwd-h3 DPKG is earlier than 3.0-2+etch2

Definition Id: oval:org.mitre.oval:def:8025

Oval ID:	oval:org.mitre.oval:def:8025
Title:	DSA-1829 sork-passwd-h3 -- insufficient input sanitising
Description:	It was discovered that sork-passwd-h3, a Horde3 module for users to change their password, is prone to a cross-site scripting attack via the backend parameter.
Family:	unix	Class:	patch
Reference(s):	DSA-1829 CVE-2009-2360	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	sork-passwd-h3
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Installed architecture is all AND sork-passwd-h3 is earlier than 3.0-2+lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND sork-passwd-h3 is earlier than 3.0-2+etch1

Definition Id: oval:org.mitre.oval:def:8083

Oval ID:	oval:org.mitre.oval:def:8083
Title:	DSA-1770 imp4 -- Insufficient input sanitising
Description:	Several vulnerabilities have been found in imp4, a webmail component for the horde framework. The Common Vulnerabilities and Exposures project identifies the following problems: It was discovered that imp4 suffers from a cross-site scripting (XSS) attack via the user field in an IMAP session, which allows attackers to inject arbitrary HTML code. It was discovered that imp4 is prone to several cross-site scripting (XSS) attacks via several vectors in the mail code allowing attackers to inject arbitrary HTML code.
Family:	unix	Class:	patch
Reference(s):	DSA-1770 CVE-2008-4182 CVE-2009-0930	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	imp4
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND imp4 is earlier than 4.1.3-4etch1

Definition Id: oval:org.mitre.oval:def:8165

Oval ID:	oval:org.mitre.oval:def:8165
Title:	DSA-1765 horde3 -- Multiple vulnerabilities
Description:	Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: Gunnar Wrobel discovered a directory traversal vulnerability, which allows attackers to include and execute arbitrary local files via the driver parameter in Horde_Image. It was discovered that an attacker could perform a cross-site scripting attack via the contact name, which allows attackers to inject arbitrary html code. This requires that the attacker has access to create contacts. It was discovered that the horde XSS filter is prone to a cross-site scripting attack, which allows attackers to inject arbitrary html code. This is only exploitable when Internet Explorer is used.
Family:	unix	Class:	patch
Reference(s):	DSA-1765 CVE-2009-0932 CVE-2008-3330 CVE-2008-5917	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	horde3
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND Installed architecture is all AND horde3 is earlier than 3.1.3-4etch5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Debian Horde cpe:2.3:a:debian:horde:3.3.2:::::::* cpe:2.3:a:debian:horde:3.3.1:::::::* cpe:2.3:a:debian:horde:3.3:::::::* cpe:2.3:a:debian:horde:3.2.3:::::::* cpe:2.3:a:debian:horde:3.2.2:::::::* cpe:2.3:a:debian:horde:3.2:::::::*	6
Application	Debian Horde Groupware cpe:2.3:a:debian:horde_groupware:1.1.4:::::::* cpe:2.3:a:debian:horde_groupware:1.1.3:::::::* cpe:2.3:a:debian:horde_groupware:1.1.2:::::::* cpe:2.3:a:debian:horde_groupware:1.1.1:::::::*	4
Application	Debian Horde Imp cpe:2.3:a:debian:horde_imp:4.0:::::::*	1
Application	Horde Application Framework cpe:2.3:a:horde:application_framework:3.3:::::::* cpe:2.3:a:horde:application_framework:3.2.2:::::::*	2
Application	Horde Passwd cpe:2.3:a:horde:passwd:2.2.2:::::::* cpe:2.3:a:horde:passwd:2.2.1:::::::* cpe:2.3:a:horde:passwd:2.2:::::::* cpe:2.3:a:horde:passwd:2.1:::::::* cpe:2.3:a:horde:passwd:2.0:::::::*	5

ExploitDB Exploits

id	Description
2011-02-11	Horde Horde_Image::factory driver Argument Local File Inclusion

OpenVAS Exploits

Date	Description
2011-02-17	Name : Horde Products Local File Inclusion Vulnerability File : nvt/gb_horde_lfi_vuln.nasl
2010-04-06	Name : Fedora Update for horde FEDORA-2010-5483 File : nvt/gb_fedora_2010_5483_horde_fc11.nasl
2010-04-06	Name : Fedora Update for imp FEDORA-2010-5508 File : nvt/gb_fedora_2010_5508_imp_fc11.nasl
2010-04-06	Name : Fedora Update for horde FEDORA-2010-5520 File : nvt/gb_fedora_2010_5520_horde_fc12.nasl
2009-09-15	Name : Gentoo Security Advisory GLSA 200909-14 (horde horde-imp horde-passwd) File : nvt/glsa_200909_14.nasl
2009-07-29	Name : Debian Security Advisory DSA 1829-1 (sork-passwd-h3) File : nvt/deb_1829_1.nasl
2009-07-29	Name : Debian Security Advisory DSA 1829-2 (sork-passwd-h3) File : nvt/deb_1829_2.nasl
2009-07-29	Name : Ubuntu USN-799-1 (dbus) File : nvt/ubuntu_799_1.nasl
2009-07-29	Name : Ubuntu USN-801-1 (tiff) File : nvt/ubuntu_801_1.nasl
2009-07-29	Name : Ubuntu USN-802-1 (apache2) File : nvt/ubuntu_802_1.nasl
2009-04-15	Name : Debian Security Advisory DSA 1765-1 (horde3) File : nvt/deb_1765_1.nasl
2009-04-15	Name : Debian Security Advisory DSA 1770-1 (imp4) File : nvt/deb_1770_1.nasl
2009-04-10	Name : Horde XSS Filter Cross Site Scripting Vulnerability File : nvt/horde_33367.nasl
2009-04-10	Name : Horde Products Local File Include and Cross Site Scripting Vulnerabilities File : nvt/horde_33491.nasl
2009-03-31	Name : SuSE Security Summary SUSE-SR:2009:007 File : nvt/suse_sr_2009_007.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
55665	Passwd Module for Horde passwd/main.php backend Parameter XSS Passwd Module for Horde contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the back-end parameter upon submission to the passwd/main.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
53540	Horde Application Framework framework/Text_Filter/Filter/xss.php Style Attrib...
51888	Horde Multile Products horde/services/portal/cloud_search.php Unspecified Par...
51887	Horde Multiple Products framework/Image/Image.php Horde_ImageDriver Name Trav...
51828	IMP message.php Unspecified Parameter XSS IMP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified parameters upon submission to the message.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
51827	IMP pgp.php Unspecified Parameter XSS IMP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified parameters upon submission to the pgp.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
51826	IMP smime.php Unspecified Parameter XSS IMP contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate unspecified parameters upon submission to the smime.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Nessus® Vulnerability Scanner

Date	Description
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-5483.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-5508.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-5520.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-5563.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1829.nasl - Type : ACT_GATHER_INFO
2009-09-14	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200909-14.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_horde-090319.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_imp-090318.nasl - Type : ACT_GATHER_INFO
2009-04-14	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1770.nasl - Type : ACT_GATHER_INFO
2009-04-09	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1765.nasl - Type : ACT_GATHER_INFO
2009-03-24	Name : The remote openSUSE host is missing a security update. File : suse_horde-6099.nasl - Type : ACT_GATHER_INFO
2009-03-24	Name : The remote openSUSE host is missing a security update. File : suse_imp-6101.nasl - Type : ACT_GATHER_INFO
2009-01-29	Name : The remote web server contains a PHP application that is susceptible to a loc... File : horde_image_driver_type_lfi.nasl - Type : ACT_ATTACK

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:36:43	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	2
CWE ID(s)	5
Oval ID(s)	7
CPE ID(s)	18
osvdb(s)	7
ExploitDB Exploit(s)	1
Openvas Exploit(s)	15
Nessus® Exploit(s)	13

	Related
6.4	CVE-2009-0932
4.3	CVE-2009-2360
4.3	CVE-2009-0931
4.3	CVE-2009-0930
4.3	CVE-2008-5917
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 5 more Alert(s)