Vulnerability Scanning Solutions, LLC.
Our Process
What We Scan For
Sample Report
Client List
Contact Us
What We Scan For
Family: Debian Local Security Checks --> Category: infos

[DSA073] DSA-073-1 imp Vulnerability Scan

Vulnerability Scan Summary
DSA-073-1 imp

Detailed Explanation for this Vulnerability Test

The Horde team released version 2.2.6 of IMP (a web based IMAP mail
program) which fixes three security problems. Their release announcement
describes them as follows:

A PHPLIB vulnerability allowed a possible hacker to provide a value for the
array element $_PHPLIB[libdir], and thus to get scripts from another
server to load and execute. This vulnerability is remotely
exploitable. (Horde 1.2.x ships with its own customized version of
PHPLIB, which has now been patched to prevent this problem.)

By using tricky encodings of "javascript:" a possible hacker can cause
malicious JavaScript code to execute in the browser of a user reading
email sent by attacker. (IMP 2.2.x already filters many such
several new ones that were slipping past the filters are
now blocked.)

A hostile user that can create a publicly-readable file named
"prefs.lang" somewhere on the Apache/PHP server can cause that file
to be executed as PHP code. The IMP configuration files could thus
be read, the Horde database password used to read and alter the
database used to store contacts and preferences, etc. We do not
believe this is remotely exploitable directly through Apache/PHP/IMP

however, shell access to the server or other means (e.g., FTP) could
be used to create this file.

This has been fixed in version 2:2.2.6-0.potato.1. Please note that you
will also need to upgrade the horde package to the same version.

Solution :
Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.


P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.