Bug 928835 (CVE-2013-1904)

Summary:	CVE-2013-1904 roundcubemail: Local file inclusion via web UI modification of certain config options
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	christoph.wickert, gwync, mhlavink, tmraz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	roundcubemail-0.8.6, roundcubemail-0.7.3	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-01-31 10:24:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	928836, 928837
Bug Blocks:

Description Jan Lieskovsky 2013-03-28 14:39:36 UTC

A local file inclusion flaw was found in the way Round Cube Webmail, a browser-based multilingual IMAP client, performed validation of the 'generic_message_footer' value provided via web user interface in certain circumstances. A remote attacker could issue a specially-crafted request that, when processed by Round Cube Webmail could allow an attacker to obtain arbitrary file on the system, accessible with the privileges of the user running Round Cube Webmail client.

References:
[1] http://sourceforge.net/news/?group_id=139281&id=310497
[2] http://lists.roundcube.net/pipermail/dev/2013-March/022328.html
[3] https://bugs.gentoo.org/show_bug.cgi?id=463554

Upstream patches:
[4] http://ow.ly/jtQD0
[5] http://ow.ly/jtQHM
[6] http://ow.ly/jtQK0
[7] http://ow.ly/jtQNd

Comment 1 Jan Lieskovsky 2013-03-28 14:41:37 UTC

This issue affects the versions of the roundcubemail package, as shipped with Fedora release of 18, 17, and Fedora EPEL-6. Please schedule an update.

--

This issue did NOT affect the version of the roundcubemail package, as shipped with Fedora EPEL-5, yet.

Comment 2 Jan Lieskovsky 2013-03-28 14:43:05 UTC

Created roundcubemail tracking bugs for this issue

Affects: fedora-all [bug 928836]
Affects: epel-6 [bug 928837]

Comment 3 Jan Lieskovsky 2013-03-28 14:49:13 UTC

CVE Request:
  http://www.openwall.com/lists/oss-security/2013/03/28/4

Comment 4 Jan Lieskovsky 2013-03-29 13:52:36 UTC

The CVE identifier of CVE-2013-1904 has been assigned to this issue:
  http://www.openwall.com/lists/oss-security/2013/03/28/8