Bug 1417865 (CVE-2015-2180)

Summary:	CVE-2015-2180 roundcubemail: New password not sanitized against injecting shell meta characters in DBMail driver
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	fedora, gwync, mhlavink, pokorra.mailinglists, tmraz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	roundcubemail 1.1.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-03-14 15:22:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1417866, 1417867
Bug Blocks:

Description Andrej Nemec 2017-01-31 10:37:04 UTC

Roundcube is shipped with the Password plugin. It is, as any other plugin, disabled by default. Once enabled, it allows an authenticated user to change his current password in the web interface. For this purpose, the plugin offers several drivers that can be used to perform the actual password change in the back end.

The DBMail driver suffers from a critical Remote Command Execution vulnerability that enables an attacker to execute arbitrary system commands with root privileges.

Upstream bug:

https://github.com/roundcube/roundcubemail/issues/4757

Upstream patch:

https://github.com/roundcube/roundcubemail/commit/7c96646de0efda16cded8491138bfefe31aca940

Comment 1 Andrej Nemec 2017-01-31 10:38:16 UTC

Created roundcubemail tracking bugs for this issue:

Affects: epel-5 [bug 1417867]
Affects: epel-6 [bug 1417866]