Bug 88967

Summary:	www-apps/eGroupWare: Exposure of Mail Attachments
Product:	Gentoo Linux	Reporter:	Jean-François Brunette (RETIRED) <formula7>
Component:	Current packages	Assignee:	Gentoo Web Application Packages Maintainers <web-apps>
Status:	RESOLVED TEST-REQUEST
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	All
URL:	http://secunia.com/advisories/14940/
Whiteboard:
Package list:		Runtime testing required:	---

Description Jean-François Brunette (RETIRED) gentoo-dev

2005-04-13 08:25:24 UTC

Description:
Gerald Quakenbush has discovered a security issue in eGroupWare, which may expose sensitive information to malicious people.

The problem is that if a mail with an attachment is composed, but not sent, then the next mail in the same session includes the attachment without this immediately can be seen by the user.

This may potentially cause sensitive information in attachments to be disclosed to other recipients than intended without the user's knowledge.

The security issue has been confirmed in version 1.0.0.006. Other versions may also be affected.

Solution:
Check for "hidden" attachments by clicking "Attach File" before sending mails

Comment 1 Jean-François Brunette (RETIRED) gentoo-dev

2005-04-13 08:31:13 UTC

*** Bug 88968 has been marked as a duplicate of this bug. ***

Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2005-04-13 09:05:47 UTC

web-apps please advise.

Comment 3 Thierry Carrez (RETIRED) gentoo-dev

2005-04-14 00:57:07 UTC

Not sure this is a security issue, since I don't see how it can be "exploited". It sure is a bug compromising privacy, though.

Comment 4 Thierry Carrez (RETIRED) gentoo-dev

2005-04-15 01:02:56 UTC

Reassigning. This bug sucks, but isn't exploitable by an attacker to get sensitive information. web-apps: reassign back to us if you disagree.

Comment 5 Renat Lumpau (RETIRED) gentoo-dev

2005-07-06 04:41:41 UTC

Please test with 1.0.0.007-r1 and reopen the bug if the problem persists.