Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 488954 (CVE-2013-6172)

Summary: <mail-client/roundcube-{0.8.7,0.9.5} : random file access, manipulated SQL queries and even code execution (CVE-2013-6172)
Product: Gentoo Security Reporter: Benny Pedersen <me>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: major CC: alex_y_xu, gentoo_bugs_peep, web-apps
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: All   
URL: http://roundcube.net/download/
Whiteboard: B1 [glsa]
Package list:
Runtime testing required: ---
Attachments:
Description Flags
roundcube 0.8.7 ebuild
none
roundcube 0.9.5 ebuild none

Description Benny Pedersen 2013-10-21 21:56:54 UTC
Dear Roundcube users

We just published new releases which fix a recently reported
vulnerability that allows an attacker to overwrite configuration
settings using user preferences. This can result in random file
access, manipulated SQL queries and even code execution. The latter
one only affects versions 0.8.6 and older.

Beside the security fix, the 0.9.5 release also includes other minor
bug fixes and improvements. Most notably it brings the default spell
checker back after Google suspended their public spell checking
service.

Please update your installations with the new versions or patch them
with the fixes listed below for the various older versions of
Roundcube.

Download the new versions from http://roundcube.net/download

Patch for 0.9.x:
https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff

Patch for 0.8.x:
https://github.com/roundcube/roundcubemail/commit/eb433aa33c.diff

Patch for 0.7.x:
https://github.com/roundcube/roundcubemail/commit/1972037274.diff

More information about the vulnerability will be published under CVE-2013-6172.

Kind regards,
Thomas

Reproducible: Always
Comment 1 Agostino Sarubbo gentoo-dev 2013-10-22 12:23:50 UTC
*** Bug 488994 has been marked as a duplicate of this bug. ***
Comment 2 Andrew Hamilton 2013-10-25 01:00:30 UTC
Created attachment 361858 [details]
roundcube 0.8.7 ebuild

ebuild for roundcube 0.8.7; copied from 0.8.6
Comment 3 Andrew Hamilton 2013-10-25 01:01:02 UTC
Created attachment 361860 [details]
roundcube 0.9.5 ebuild

ebuild for roundcube 0.9.5; copied from 0.9.4.
Comment 4 Tim Harder gentoo-dev 2013-10-25 17:49:40 UTC
(In reply to Andrew Hamilton from comment #3)
> Created attachment 361860 [details]
> roundcube 0.9.5 ebuild
> 
> ebuild for roundcube 0.9.5; copied from 0.9.4.

You really don't need to attach trivially modified ebuilds.
Comment 5 Tim Harder gentoo-dev 2013-10-25 18:04:02 UTC
Arches, please stabilize:

=mail-client/roundcube-0.8.7

and 

=mail-client/roundcube-0.9.5
Comment 6 Agostino Sarubbo gentoo-dev 2013-10-26 06:46:45 UTC
All stable, please cleanup
Comment 7 Benny Pedersen 2013-10-27 23:54:26 UTC
i readed on bugs.g.o there is now webapp-config override configs :(

it was a problem i only thinked wordpress had :(

new bugs ?
Comment 8 Alex Xu (Hello71) 2013-10-27 23:56:51 UTC
If this is not related to the security GLSA or cleanup of old ebuilds, please file a new bug.
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2013-11-27 21:34:11 UTC
CVE-2013-6172 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-6172):
  steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before
  0.9.5 allows remote attackers to modify configuration settings via the
  _session parameter, which can be leveraged to read arbitrary files, conduct
  SQL injection attacks, and execute arbitrary code.
Comment 10 Sergey Popov gentoo-dev 2013-11-28 08:01:09 UTC
  12 Nov 2013; Tim Harder <radhermit@gentoo.org> -roundcube-0.8.6.ebuild,
  -roundcube-0.9.2.ebuild, -roundcube-0.9.3.ebuild, -roundcube-0.9.4.ebuild:
  Remove old.

Cleanup was done, GLSA request filed, thanks to all
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2014-02-11 09:25:33 UTC
This issue was resolved and addressed in
 GLSA 201402-15 at http://security.gentoo.org/glsa/glsa-201402-15.xml
by GLSA coordinator Sergey Popov (pinkbyte).