Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2012:072 First vendor Publication 2012-05-10
Vendor Mandriva Last vendor Modification 2012-05-10
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been found and corrected in roundcubemail:

The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a login CSRF issue (CVE-2011-1491).

steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request (CVE-2011-1492).

Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI (CVE-2011-2937).

include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379 (CVE-2011-4078).

The updated packages have been upgraded to the 0.7.2 version which is not affected by these issues.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:072

CWE : Common Weakness Enumeration

% Id Name
40 % CWE-20 Improper Input Validation
20 % CWE-399 Resource Management Errors
20 % CWE-94 Failure to Control Generation of Code ('Code Injection')
20 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 2
Application 39

OpenVAS Exploits

Date Description
2012-09-26 Name : Gentoo Security Advisory GLSA 201209-03 (php)
File : nvt/glsa_201209_03.nasl
2012-06-25 Name : Fedora Update for roundcubemail FEDORA-2012-9329
File : nvt/gb_fedora_2012_9329_roundcubemail_fc15.nasl
2012-06-25 Name : Fedora Update for roundcubemail FEDORA-2012-9337
File : nvt/gb_fedora_2012_9337_roundcubemail_fc16.nasl
2012-04-02 Name : Fedora Update for php FEDORA-2011-13472
File : nvt/gb_fedora_2011_13472_php_fc16.nasl
2012-02-06 Name : Mac OS X Multiple Vulnerabilities (2012-001)
File : nvt/gb_macosx_su12-001.nasl
2011-11-08 Name : Mandriva Update for php MDVSA-2011:166 (php)
File : nvt/gb_mandriva_MDVSA_2011_166.nasl
2011-11-08 Name : PHP 'is_a()' Function Remote Arbitrary Code Execution Vulnerability (Windows)
File : nvt/gb_php_is_a_fun_arbitrary_code_exec_vuln_win.nasl
2011-10-12 Name : PHP 'is_a()' Function Remote File Include Vulnerability
File : nvt/gb_php_49754.nasl
2011-10-10 Name : Fedora Update for php FEDORA-2011-13446
File : nvt/gb_fedora_2011_13446_php_fc15.nasl
2011-10-10 Name : Fedora Update for php FEDORA-2011-13458
File : nvt/gb_fedora_2011_13458_php_fc14.nasl
2011-09-21 Name : FreeBSD Ports: roundcube
File : nvt/freebsd_roundcube1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
77047 Roundcube Webmail include/iniset.php Subject Header Parsing Remote DoS
75713 PHP is_a() Function __autoload() Function Remote File Inclusion
74567 RoundCube Webmail Multiple Unspecified Script _mbox Parameter XSS

RoundCube Webmail contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the '_mbox' parameter upon submission to multiple unspecified scripts. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.
73871 Roundcube Webmail Login Form Email Message Composition Remote Information Dis...
73870 Roundcube Webmail steps/utils/modcss.inc External CSS Request Remote Informat...

Nessus® Vulnerability Scanner

Date Description
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2011-7.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2011-07.nasl - Type : ACT_GATHER_INFO
2012-09-24 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-03.nasl - Type : ACT_GATHER_INFO
2012-07-05 Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_1_1_1.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9329.nasl - Type : ACT_GATHER_INFO
2012-06-25 Name : The remote Fedora host is missing a security update.
File : fedora_2012-9337.nasl - Type : ACT_GATHER_INFO
2012-02-02 Name : The remote host is missing a Mac OS X update that fixes several security vuln...
File : macosx_10_7_3.nasl - Type : ACT_GATHER_INFO
2012-01-13 Name : The remote web server uses a version of PHP that is affected by multiple flaws.
File : php_5_3_9.nasl - Type : ACT_GATHER_INFO
2011-11-04 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-166.nasl - Type : ACT_GATHER_INFO
2011-10-10 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13446.nasl - Type : ACT_GATHER_INFO
2011-10-10 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13458.nasl - Type : ACT_GATHER_INFO
2011-10-10 Name : The remote Fedora host is missing a security update.
File : fedora_2011-13472.nasl - Type : ACT_GATHER_INFO
2011-09-13 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_4ae68e7cdda411e0a90600215c6a37bb.nasl - Type : ACT_GATHER_INFO