PT-2009-5552 · Horde+1 · Horde Application Framework+3

Stefan Esser

·

Publicado

2009-09-17

·

Atualizado

2019-06-18

·

CVE-2009-3236

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Horde Application Framework versions 3.2 through 3.2.4 Horde Application Framework versions 3.3 through 3.3.4 Horde Groupware versions 1.1 through 1.1.5 Horde Groupware versions 1.2 through 1.2.3 Horde Groupware Webmail Edition versions 1.1 through 1.1.5 Horde Groupware Webmail Edition versions 1.2 through 1.2.3
Description The issue allows remote attackers with address book write privileges to overwrite arbitrary files and execute PHP code by reusing temporary filenames during the upload process. This is achieved through crafted Horde Form Type image form field elements.
Recommendations For Horde Application Framework versions 3.2 through 3.2.4, update to version 3.2.5 or later. For Horde Application Framework versions 3.3 through 3.3.4, update to version 3.3.5 or later. For Horde Groupware versions 1.1 through 1.1.5, update to version 1.1.6 or later. For Horde Groupware versions 1.2 through 1.2.3, update to version 1.2.4 or later. For Horde Groupware Webmail Edition versions 1.1 through 1.1.5, update to version 1.1.6 or later. For Horde Groupware Webmail Edition versions 1.2 through 1.2.3, update to version 1.2.4 or later.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2009-3236
DSA-1897-1

Produtos afetados

Horde Application Framework
Horde Groupware
Horde Groupware Webmail Edition
Php