Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 193960 - www-apps/egroupware < 1.4.002 "cat_data[color]" Cross-Site Scripting (CVE-2007-5091)
Summary: www-apps/egroupware < 1.4.002 "cat_data[color]" Cross-Site Scripting (CVE-200...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://secunia.com/advisories/26944/
Whiteboard: B4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2007-09-27 09:02 UTC by Pierre-Yves Rofes (RETIRED)
Modified: 2007-10-11 21:31 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-09-27 09:02:01 UTC
Enrico Milanese has reported a vulnerability in eGroupWare, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "cat_data[color]" parameter in preferences/inc/class.uicategories.inc.php and admin/inc/class.uicategories.inc.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in version 1.4.001. Other versions may also be affected.

Solution:
Fixed in the SVN repository.

Provided and/or discovered by:
Enrico Milanese

Original Advisory:
http://www.egroupware.org/viewvc?view=rev&revision=24443
Comment 1 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-09-27 09:04:05 UTC
web-apps please advise.
Comment 2 Robert Buchholz (RETIRED) gentoo-dev 2007-09-27 21:19:53 UTC
This is CVE-2007-5091.
Comment 3 Gunnar Wrobel (RETIRED) gentoo-dev 2007-09-29 15:19:39 UTC
Version 1.4.002 is in the tree and should be marked stable on the following arches:

alpha amd64 hppa ppc x86
Comment 4 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-09-29 15:26:20 UTC
(In reply to comment #3)
> Version 1.4.002 is in the tree and should be marked stable on the following
> arches:
> 
> alpha amd64 hppa ppc x86
> 

Thanks gunnar.
Comment 5 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-09-29 15:27:22 UTC
oops, seems some arches weren't added.
Comment 6 Jeroen Roovers (RETIRED) gentoo-dev 2007-09-29 16:08:45 UTC
Er, so that's =www-apps/egroupware-1.4.002 then.
Comment 7 Jeroen Roovers (RETIRED) gentoo-dev 2007-09-29 17:23:51 UTC
Stable for HPPA.
Comment 8 Markus Meier gentoo-dev 2007-09-30 15:15:17 UTC
x86 stable
Comment 9 Tobias Scherbaum (RETIRED) gentoo-dev 2007-09-30 19:58:31 UTC
ppc stable
Comment 10 Raúl Porcel (RETIRED) gentoo-dev 2007-10-01 13:22:16 UTC
alpha stable
Comment 11 Angelo Arrifano (RETIRED) gentoo-dev 2007-10-05 00:52:23 UTC
www-apps/egroupware-1.4.002  USE="gd mysql vhosts -jpgraph -ldap -postgres"

- Emerges on AMD64.
- I didn't have resources to test all the functionality. Although the setup wizard ran well.
Comment 12 Mike Doty (RETIRED) gentoo-dev 2007-10-11 07:20:33 UTC
amd64 stable, thanks mixnix
Comment 13 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-10-11 07:26:50 UTC
time for glsa decision. I vote NO.
Comment 14 Gunnar Wrobel (RETIRED) gentoo-dev 2007-10-11 09:13:53 UTC
Removed insecure version. webapps done here.
Comment 15 Matt Drew (RETIRED) gentoo-dev 2007-10-11 21:28:44 UTC
XSS, I vote no.
Comment 16 Pierre-Yves Rofes (RETIRED) gentoo-dev 2007-10-11 21:31:48 UTC
closing without glsa.