It was reported that turba does not properly check permissions on address books, allowing users to modify addresses in other users' address books. This problem affects both shared and non-shared address books. Knowing (or guessing) the object_id seems to be sufficient to allow modification of other users' addresses. More information can be found in Debian bug report, which also contains some proposed patches: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058 Upstream bug report: http://bugs.horde.org/ticket/?id=6208
Turba 2.1.7 is out with the patches, final versions can also be found at Debian's.
Thanks Robert. From news section on project upstream page: 2008-02-15: The Turba Contact Manager versions H3 (2.2-RC3) and H3 (2.1.7) have been released. These are security releases that fix unchecked access to contacts in the same SQL table, if the unique key of another user's contact can be guessed. Patch in Debian BTS: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=94;filename=turba_2.1.7.patch;att=3;bug=464058
Brandon: Ping. Do you need help doing the fix?
Update build in koji.
imp-4.1.6-1.fc7,horde-3.1.6-1.fc7,turba-2.1.7-1.fc7 has been submitted as an update for Fedora 7
horde-3.1.6-1.fc8,turba-2.1.7-1.fc8,imp-4.1.6-1.fc8 has been submitted as an update for Fedora 8
Thanks Jan! Bodhi will take care of closing this bug once updates are pushed to stable repositories.
imp-4.1.6-1.fc7, horde-3.1.6-1.fc7, turba-2.1.7-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
horde-3.1.6-1.fc8, turba-2.1.7-1.fc8, imp-4.1.6-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.