PT-2017-2370 · Horde · Horde Groupware Webmail Edition+1

Publicado 2017-04-04 · Atualizado 2019-10-03 · CVE-2017-7413

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Horde Crypt versions prior to 2.7.6 Horde Groupware Webmail Edition versions prior to 5.2.18

Description The issue is related to a lack of input data sanitization, which can lead to OS Command Injection. This can occur if an attacker is an authenticated Horde Webmail user with PGP features enabled in their preferences and attempts to encrypt an email addressed to a maliciously crafted email address.

Recommendations For Horde Crypt versions prior to 2.7.6, update to version 2.7.6 or later. For Horde Groupware Webmail Edition versions prior to 5.2.18, update to version 5.2.18 or later. As a temporary workaround, consider disabling the PGP features in user preferences until a patch is available.

Correção

OS Command Injection

Command Injection

Enumeração de Fraquezas

CWE-78

CWE-77

Identificadores relacionados

BDU:2017-01570

CVE-2017-7413

DLA-1398-1

Produtos afetados

Horde Groupware Webmail Edition

Horde Crypt

Referências · 16

• https://security-tracker.debian.org/tracker/CVE-2017-7413 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-7413 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7413 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-01570 · Nota de Segurança
• https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-7413 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1398-1 · Aviso do Fabricante
• https://packages.debian.org/src:php-horde-crypt · Nota
• https://security-tracker.debian.org/tracker/source-package/php-horde-crypt · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7413 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7413 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7414 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7413 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7413 · Aviso do Fabricante