Secunia

A vulnerability has been reported in various Horde products, which can be exploited by malicious users to disclose sensitive information and potentially compromise a vulnerable system.

Input passed to the "theme" parameter is not properly sanitised before being used. This can be exploited to include arbitrary files from local resources, using directory traversal attacks and URL-encoded NULL bytes ("%00").

NOTE: Other attack vectors are also reported to exist.

Successful exploitation may allow execution of arbitrary code, but requires valid user credentials.

The vulnerability is confirmed in Horde Application Framework 3.1.6 and also reported in Horde Groupware 1.0.4 and Horde Groupware Webmail Edition 1.0.5. Prior versions may also be affected.

Solution
Update to Horde Application Framework 3.1.7, Horde Groupware 1.0.5, or Horde Groupware Webmail Edition 1.0.6.

Provided and/or discovered by
David Collins, Patrick Pelanne, and others from HostGator.com LLC support team

Changelog
Further details available in Customer Area

Original Advisory
Horde:
http://lists.horde.org/archives/announce/2008/000382.html
http://lists.horde.org/archives/announce/2008/000383.html
http://lists.horde.org/archives/announce/2008/000384.html

HostGator:
http://seclists.org/bugtraq/2008/Mar/0074.html

Deep Links
Links available in Customer Area