PT-2008-2876 · Horde · Horde Groupware+2

Published 2008-03-11 · Updated 2018-10-11 · CVE-2008-1284

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Horde version 3.1.6 Horde Groupware versions prior to 1.0.5 Horde Groupware Webmail Edition versions prior to 1.0.6

Description The issue allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name. This can occur when running with certain configurations.

Recommendations For Horde version 3.1.6, update to a version later than 3.1.6 to resolve the issue. For Horde Groupware versions prior to 1.0.5, update to version 1.0.5 or later. For Horde Groupware Webmail Edition versions prior to 1.0.6, update to version 1.0.6 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-1284

DSA-1519-1

Affected Products

Horde

Horde Groupware

Horde Groupware Webmail Edition

References · 19

• http://secunia.com/advisories/29286 · Vendor Advisory
• http://securityfocus.com/bid/28153 · Patch
• http://debian.org/security/2008/dsa-1519 · Vendor Advisory
• http://secunia.com/advisories/29374 · Vendor Advisory
• http://secunia.com/advisories/30047 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1284 · Security Note
• http://secunia.com/advisories/29400 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00253.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-March/msg00301.html · Vendor Advisory
• http://lists.horde.org/archives/announce/2008/000382.html · Patch
• http://security.gentoo.org/glsa/glsa-200805-01.xml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41054 · Note
• http://securityreason.com/securityalert/3726 · Note
• http://lists.horde.org/archives/announce/2008/000383.html · Note
• http://vupen.com/english/advisories/2008/0822/references · Note