secunia: Description: Some vulnerabilities have been reported in various Horde products, which can be exploited by malicious users to conduct script insertion attacks and by malicious people to conduct cross-site scripting attacks. 1) Input passed to item names is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires valid user credentials. The vulnerability is reported in Horde versions prior to 3.1.8 and 3.2.1, Horde Groupware versions prior to 1.1.1, and Horde Groupware Webmail Edition versions prior to 1.1.1. 2) Input passed to contact views is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires valid user credentials. The vulnerability is reported in Horde Groupware versions prior to 1.1.1 and Horde Groupware Webmail Edition versions prior to 1.1.1. 3) Input passed to unspecified input is not properly sanitised before being returned to the user in the add event screen. This can be exploited to execute arbitrary HTML and script code in a user's browser session in contact of an affected site. The vulnerability is reported in Horde Groupware versions prior to 1.0.6 and Horde Groupware Webmail Edition versions prior to 1.0.7. Solution: Horde Application Framework: Update to version 3.1.8 or 3.2.1 Horde Groupware: Update to version 1.1.1 or 1.0.6. Horde Groupware Webmail Edition: Update to version 1.1.1 or 1.0.7. Provided and/or discovered by: 1) Reported by Nicolas Kerschenbaum. 2, 3) Reported by the vendor. Original Advisory: Horde: http://lists.horde.org/archives/announce/2008/000416.html http://lists.horde.org/archives/announce/2008/000415.html http://lists.horde.org/archives/announce/2008/000419.html http://lists.horde.org/archives/announce/2008/000417.html http://lists.horde.org/archives/announce/2008/000420.html http://lists.horde.org/archives/announce/2008/000418.html
security relevant changes for 1.1.1: http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.19&r2=1.20&ty=h Horde Changes [cjh] SECURITY: Escape item names in the object browser (Bug #6906) Address Book Changes -------------------- [cjh] SECURITY: Escape contact names in the contact display view. _______________________ security relevant changes for 1.0.7 http://cvs.horde.org/diff.php/groupware/docs/webmail/CHANGES?r1=1.12.2.3&r2=1.12.2.4&ty=h Horde Changes ------------- [cjh] SECURITY: Escape item names in the object browser (Bug #6906). Calendar Changes ---------------- [cjh] SECURITY: Fix XSS in the add event screen.
Added horde-webmail-{1.0.7,1.1.1}, removed horde-webmail-{1.0.6,1.1}. Unstable on all archs. webapps done.
thanks, closing.
CVE-2008-3650 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3650): Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related to "unescaped output," possibly cross-site scripting (XSS), in the (1) object browser and (2) contact view.
