Bug 432027 - (CVE-2008-0807) CVE-2008-0807 turba: insufficient access checks
CVE-2008-0807 turba: insufficient access checks
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jan ONDREJ
source=debian,reported=20080207,publi...
: Reopened, Security
Depends On: 433318 433319 433320
Blocks:
  Show dependency treegraph
 
Reported: 2008-02-08 09:19 EST by Tomas Hoger
Modified: 2008-02-28 16:41 EST (History)
2 users (show)

See Also:
Fixed In Version: 3.1.6-1.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-02-28 16:41:37 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2008-02-08 09:19:22 EST
It was reported that turba does not properly check permissions on address books,
allowing users to modify addresses in other users' address books.  This problem
affects both shared and non-shared address books.  Knowing (or guessing) the
object_id seems to be sufficient to allow modification of other users' addresses.

More information can be found in Debian bug report, which also contains some
proposed patches:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=464058

Upstream bug report:
http://bugs.horde.org/ticket/?id=6208
Comment 1 Robert Buchholz 2008-02-15 20:51:07 EST
Turba 2.1.7 is out with the patches, final versions can also be found at Debian's.
Comment 2 Tomas Hoger 2008-02-18 11:44:21 EST
Thanks Robert.

From news section on project upstream page:

  2008-02-15: The Turba Contact Manager versions H3 (2.2-RC3) and H3 (2.1.7)
  have been released. These are security releases that fix unchecked access to
  contacts in the same SQL table, if the unique key of another user's contact
  can be guessed.

Patch in Debian BTS:
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=94;filename=turba_2.1.7.patch;att=3;bug=464058
Comment 4 Lubomir Kundrak 2008-02-26 03:00:24 EST
Brandon: Ping. Do you need help doing the fix?
Comment 5 Jan ONDREJ 2008-02-26 04:45:32 EST
Update build in koji.
Comment 6 Fedora Update System 2008-02-26 05:03:45 EST
imp-4.1.6-1.fc7,horde-3.1.6-1.fc7,turba-2.1.7-1.fc7 has been submitted as an update for Fedora 7
Comment 7 Fedora Update System 2008-02-26 05:12:38 EST
horde-3.1.6-1.fc8,turba-2.1.7-1.fc8,imp-4.1.6-1.fc8 has been submitted as an update for Fedora 8
Comment 8 Tomas Hoger 2008-02-26 05:15:52 EST
Thanks Jan!

Bodhi will take care of closing this bug once updates are pushed to stable
repositories.
Comment 9 Fedora Update System 2008-02-28 16:35:25 EST
imp-4.1.6-1.fc7, horde-3.1.6-1.fc7, turba-2.1.7-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2008-02-28 16:41:26 EST
horde-3.1.6-1.fc8, turba-2.1.7-1.fc8, imp-4.1.6-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.