|
 |
|
Multiple Horde Products Security Bypass
|
|
|
|
|
Secunia Advisory:
|
SA28982
|
|
|
Release Date:
|
2008-02-18
|
|
Last Update:
|
2008-02-25
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Security Bypass
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Horde Groupware 1.x
Horde Groupware Webmail Edition 1.x
Turba 2.x (Horde module)
|
| | CVE reference: | CVE-2008-0807 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
A security issue has been reported in multiple Horde products, which can be exploited by malicious users to bypass certain security restrictions.
The security issue is caused due to an error within the enforcing of access restriction policies imposed on the address book. This can be exploited to gain access to restricted contacts placed in the same SQL table, if the unique key of another user's contact can be obtained.
The security issue is reported in Horde Groupware 1.0.3, Horde Groupware Webmail Edition 1.0.4, and Turba Contact Manager 2.1.6. Prior versions may also be affected.
Solution:
Update to Horde Groupware 1.0.4, Horde Groupware Webmail Edition 1.0.5, and Turba Contact Manager 2.1.7.
Provided and/or discovered by:
Peter Paul Elfferich
Changelog:
2008-02-25: Updated "Provided and/or discovered by" section. Added CVE reference and link to Debian bug report.
Original Advisory:
Debian bug #464058:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058
Horde:
http://cvs.horde.org/diff.php/groupwa...?r1=1.17.2.1&r2=1.17.2.2&ty=h
http://cvs.horde.org/diff.php/groupwa...?r1=1.12.2.1&r2=1.12.2.2&ty=h
http://cvs.horde.org/diff.php/turba/d...4.2.2&r2=1.181.2.114.2.4&ty=h
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
6 Related Secunia Security Advisories
|
|
|
1. Turba Contact View Script Insertion Vulnerability
|
|
2. Horde Products Cross-Site Scripting and Script Insertion
|
|
3. Horde "theme" Local File Inclusion Vulnerability
|
|
4. Multiple Horde Products Security Bypass
|
|
5. IMP Mail Deletion Security Bypass Vulnerability
|
|
6. Turba Script Insertion Vulnerabilities
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
