Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 88967 - www-apps/eGroupWare: Exposure of Mail Attachments
Summary: www-apps/eGroupWare: Exposure of Mail Attachments
Status: RESOLVED TEST-REQUEST
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Web Application Packages Maintainers
URL: http://secunia.com/advisories/14940/
Whiteboard:
Keywords:
: 88968 (view as bug list)
Depends on:
Blocks:
 
Reported: 2005-04-13 08:24 UTC by Jean-François Brunette (RETIRED)
Modified: 2005-07-06 04:41 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-François Brunette (RETIRED) gentoo-dev 2005-04-13 08:25:24 UTC 
Description:
Gerald Quakenbush has discovered a security issue in eGroupWare, which may expose sensitive information to malicious people.

The problem is that if a mail with an attachment is composed, but not sent, then the next mail in the same session includes the attachment without this immediately can be seen by the user.

This may potentially cause sensitive information in attachments to be disclosed to other recipients than intended without the user's knowledge.

The security issue has been confirmed in version 1.0.0.006. Other versions may also be affected.

Solution:
Check for "hidden" attachments by clicking "Attach File" before sending mails
Comment 1 Jean-François Brunette (RETIRED) gentoo-dev 2005-04-13 08:31:13 UTC 
*** Bug 88968 has been marked as a duplicate of this bug. ***
Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2005-04-13 09:05:47 UTC 
web-apps please advise.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2005-04-14 00:57:07 UTC 
Not sure this is a security issue, since I don't see how it can be "exploited". It sure is a bug compromising privacy, though.
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2005-04-15 01:02:56 UTC 
Reassigning. This bug sucks, but isn't exploitable by an attacker to get sensitive information. web-apps: reassign back to us if you disagree.
Comment 5 Renat Lumpau (RETIRED) gentoo-dev 2005-07-06 04:41:41 UTC 
Please test with 1.0.0.007-r1 and reopen the bug if the problem persists.