Bug 205377 – www-apps/horde(-imp|-webmail) Mail Deletion Security Bypass Vulnerability (CVE-2007-6018)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Lars Hartmann 2008-01-12 00:05:58 UTC]

Secunia Research has discovered a vulnerability in IMP Webmail Client
and Horde Groupware Webmail Edition, which can be exploited by
malicious people to bypass certain security restrictions and
manipulate data.

The HTML filter does not filter out <frame> and <frameset> HTML
elements. Additionally, the application allows users to perform
certain actions via HTTP requests without performing any validity
checks to verify the request. This can be exploited to (a) delete an
arbitrary number of e-mail messages by referencing their numeric IDs
and (b) purge deleted mails, when the victim opens a malicious HTML
mail.

Successful exploitation requires that the victim opens the HTML part
of a malicious message.

Solution:
Update to Horde 3.1.6 or Horde Groupware Webmail Edition 1.0.4.

[Comment 1 Lars Hartmann 2008-01-12 00:07:17 UTC]

maintainers - please advise

[Comment 2 Robert Buchholz (RETIRED) 2008-01-12 01:17:02 UTC]

*** Bug 203098 has been marked as a duplicate of this bug. ***

[Comment 3 SpanKY 2008-01-12 05:30:53 UTC]

all horde packages should be bumped now

[Comment 4 Pierre-Yves Rofes (RETIRED) 2008-01-13 11:14:32 UTC]

Thanks Mike. horde-webmail is ok because of ~arch. Arches, please test and mark stable www-apps/horde-imp-4.1.6. Target "alpha amd64 hppa ppc sparc x86"

[Comment 5 Markus Meier 2008-01-13 22:42:56 UTC]

x86 stable

[Comment 6 Jeroen Roovers (RETIRED) 2008-01-15 14:36:43 UTC]

Stable for HPPA.

[Comment 7 Raúl Porcel (RETIRED) 2008-01-16 12:15:39 UTC]

alpha/sparc stable

[Comment 8 Tobias Scherbaum (RETIRED) 2008-01-18 20:27:13 UTC]

ppc stable

[Comment 9 Steve Dibb (RETIRED) 2008-01-23 16:10:01 UTC]

amd64 stable

[Comment 10 Pierre-Yves Rofes (RETIRED) 2008-02-11 22:41:08 UTC]

GLSA 200802-03