Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 388613 (CVE-2011-4078) - <mail-client/roundcube-0.6 Specific URL's in a Subject line can cause a Denial of Service (CVE-2011-4078)
Summary: <mail-client/roundcube-0.6 Specific URL's in a Subject line can cause a Denia...
Status: RESOLVED FIXED
Alias: CVE-2011-4078
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: C3 [noglsa]
Keywords:
Depends on: 385255 388763
Blocks:
  Show dependency tree
 
Reported: 2011-10-26 20:09 UTC by Sean Amoss (RETIRED)
Modified: 2012-03-06 01:05 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sean Amoss (RETIRED) gentoo-dev Security 2011-10-26 20:09:33 UTC 
From the advisory at $URL:

"A security flaw was found in the way Round Cube Webmail,
a browser-based multilingual IMAP client, processed certail
email-messages containing URL link in the message Subject,
when the Suhosin check for dangerous PHP files inclusion
was enabled. A remote attacker could send a specially-crafted
email message to the victim, leading to denial of service
(situation, where victim could not open their mail INBOX
folder with the crafted email message present)."

References:
[1] http://trac.roundcube.net/ticket/1488086
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=646675
[3] https://bugs.php.net/bug.php?id=55475 

The upstream bug contains a backported patch for roundcube 0.5.4.
Comment 1 Peter Volkov (RETIRED) gentoo-dev 2011-10-28 13:01:05 UTC 
This is fixed in 0.6 that is in the tree. Please stabilize.

=mail-client/roundcube-0.6
Target KEYWORDS="amd64 arm ppc ppc64 sparc x86"
Comment 2 Ian Delaney (RETIRED) gentoo-dev 2011-11-02 12:15:37 UTC 
amd64:

all ok
Comment 3 Agostino Sarubbo gentoo-dev 2011-11-02 18:13:52 UTC 
amd64 ok
Comment 4 Tony Vroon (RETIRED) gentoo-dev 2011-11-03 10:21:02 UTC 
+  03 Nov 2011; Tony Vroon <chainsaw@gentoo.org> roundcube-0.6.ebuild:
+  Marked stable on AMD64 based on arch testing by Ian "idella4" Delaney &
+  Agostino "ago" Sarubbo in security bug #388613.
Comment 5 Tony Vroon (RETIRED) gentoo-dev 2011-11-03 10:24:25 UTC 
(In reply to comment #4)
> +  03 Nov 2011; Tony Vroon <chainsaw@gentoo.org> roundcube-0.6.ebuild:
> +  Marked stable on AMD64 based on arch testing by Ian "idella4" Delaney &
> +  Agostino "ago" Sarubbo in security bug #388613.

This will be taking longer as the arch testers have failed to report dependencies properly. My apologies.
Comment 6 Tony Vroon (RETIRED) gentoo-dev 2011-11-03 11:44:34 UTC 
Now done.
Comment 7 Andreas Schürch gentoo-dev 2011-11-04 16:15:41 UTC 
x86 stable, thanks.
Comment 8 Raúl Porcel (RETIRED) gentoo-dev 2011-11-05 19:25:06 UTC 
sparc is not stable
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2011-11-16 23:26:43 UTC 
CVE-2011-4078 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-4078):
  include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or
  5.3.8 is used, allows remote attackers to trigger a GET request for an
  arbitrary URL, and cause a denial of service (resource consumption and inbox
  outage), via a Subject header containing only a URL, a related issue to
  CVE-2011-3379.
Comment 10 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2011-11-25 19:11:06 UTC 
ppc/ppc64 stable
Comment 11 Sean Amoss (RETIRED) gentoo-dev Security 2011-11-29 22:06:42 UTC 
Thanks, everyone. Time for a GLSA vote.
Comment 12 Tim Sammut (RETIRED) gentoo-dev 2011-12-05 05:14:58 UTC 
Thanks, everyone. GLSA Vote: no.
Comment 13 Stefan Behte (RETIRED) gentoo-dev Security 2012-03-06 01:05:15 UTC 
Vote: NO. Closing noglsa.