PT-2017-2370 · Horde · Horde Groupware Webmail Edition+1

Published 2017-04-04 · Updated 2019-10-03 · CVE-2017-7413

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Horde Crypt versions prior to 2.7.6 Horde Groupware Webmail Edition versions prior to 5.2.18

Description The issue is related to a lack of input data sanitization, which can lead to OS Command Injection. This can occur if an attacker is an authenticated Horde Webmail user with PGP features enabled in their preferences and attempts to encrypt an email addressed to a maliciously crafted email address.

Recommendations For Horde Crypt versions prior to 2.7.6, update to version 2.7.6 or later. For Horde Groupware Webmail Edition versions prior to 5.2.18, update to version 5.2.18 or later. As a temporary workaround, consider disabling the PGP features in user preferences until a patch is available.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

BDU:2017-01570

CVE-2017-7413

DLA-1398-1

Affected Products

Horde Groupware Webmail Edition

Horde Crypt

References · 16

• https://security-tracker.debian.org/tracker/CVE-2017-7413 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7413 · Security Note
• https://bdu.fstec.ru/vul/2017-01570 · Security Note
• https://lists.horde.org/archives/horde/Week-of-Mon-20170403/056767.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7413 · Security Note
• https://osv.dev/vulnerability/DLA-1398-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/php-horde-crypt · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7413 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7413 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7414 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7413 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7413 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1398-1 · Vendor Advisory
• https://packages.debian.org/src:php-horde-crypt · Note