PT-2017-17721 · Horde · Horde Groupware Webmail Edition+1

Published 2017-04-04 · Updated 2019-10-03 · CVE-2017-7414

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Horde Crypt versions prior to 2.7.6 Horde Groupware Webmail Edition versions 5.x through 5.2.17

Description The issue occurs when a user has PGP features enabled and has chosen to automatically verify PGP signed messages. An attacker can exploit this by sending a maliciously crafted PGP signed email to the user, who must then view or preview the email to trigger the exploit. This can lead to OS Command Injection.

Recommendations For Horde Crypt versions prior to 2.7.6, update to version 2.7.6 or later. For Horde Groupware Webmail Edition versions 5.x through 5.2.17, consider disabling the PGP features or the automatic verification of PGP signed messages until an update is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-7414

DLA-1398-1

Affected Products

Horde Groupware Webmail Edition

Horde Crypt

References · 16

• https://security-tracker.debian.org/tracker/CVE-2017-7414 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01570 · Security Note
• https://osv.dev/vulnerability/DLA-1398-1 · Vendor Advisory
• https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7414 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7414 · Security Note
• https://security-tracker.debian.org/tracker/source-package/php-horde-crypt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7413 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7414 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7414 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7414 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7414 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7414 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1398-1 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/06/msg00006.html · Note