Bug 461886 (CVE-2008-3823) - CVE-2008-3823 horde: XSS via filename of MIME attachments (oCERT-2008-012)
Summary: CVE-2008-3823 horde: XSS via filename of MIME attachments (oCERT-2008-012)
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-3823
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-09-11 07:40 UTC by Tomas Hoger
Modified: 2010-04-02 10:37 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-04-02 10:37:07 UTC


Attachments (Terms of Use)

Description Tomas Hoger 2008-09-11 07:40:23 UTC
oCERT reported an XSS vulnerability discovered by Alexios Fakos affecting horde:

  Horde framework fails to properly sanitize the filename of MIME attachments
  on received emails.

According to oCERT, this affects 3.2.x versions of Horde.

References:
http://www.ocert.org/advisories/ocert-2008-012.html

Patch:
http://ocert.org/patches/2008-012/MIME.patch

Comment 1 Tomas Hoger 2008-09-11 19:30:14 UTC
Advisory from the reporter:
  http://marc.info/?l=full-disclosure&m=122113948918864&w=4

Comment 2 Chris Croome 2008-12-25 23:25:11 UTC
Horde Application Framework version 3.2.2 announced on September 10th 2008 fixed this:

  The Horde Team is pleased to announce the final release of the Horde
  Application Framework version 3.2.2.
  
  This is a security release that fixes unescaped output in the MIME library
  (CVE-2008-3823), and further improves the XSS filter for HTML messages
  (CVE-2008-3824). The unescaped output vulnerability can be triggered by
  sending specially crafted e-mail messages to Horde users, if they use a Horde
  mail client. All users are encouraged to upgrade to this version.
  
  The major changes compared to the Horde version H3 (3.2.1) are:
       * Fixed unescaped output in the MIME library.
       * Further improved the XSS filter for HTML.
  
  http://lists.horde.org/archives/announce/2008/000429.html

In addition on December 10th 2008 version 3.2.3 was released:

  This is a minor security release that adds another check to the XSS filter for
  an Internet Explorer exploit. All users are encouraged to upgrade to this
  version.
  
  The major changes compared to the Horde version H3 (3.2.2) are:
       * Added another check to the XSS filter (only IE is vulnerable).
  
  http://lists.horde.org/archives/announce/2008/000462.html

There is also a 3.3.2 version but I guess that this would be a more complicated upgrade.

I haven't tested for this XSS exploit -- my interest in a 3.2.2 version of Horde is so that I can install Ansel:

  Ansel 1.0 requires version 3.2.2 or greater of the Horde Framework - earlier versions of Horde will not work.
  
  http://www.horde.org/ansel/docs/?f=INSTALL.html#prerequisites

I'm using the epel-5 package.

Comment 3 Fedora Update System 2010-03-29 17:58:21 UTC
horde-3.3.6-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/horde-3.3.6-1.fc11

Comment 4 Fedora Update System 2010-03-29 17:58:54 UTC
horde-3.3.6-1.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/horde-3.3.6-1.fc12

Comment 5 Fedora Update System 2010-03-29 18:00:44 UTC
horde-3.3.6-1.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/horde-3.3.6-1.fc13

Comment 6 Fedora Update System 2010-03-29 18:01:27 UTC
horde-3.3.6-1.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/horde-3.3.6-1.el5

Comment 7 Fedora Update System 2010-04-01 01:39:52 UTC
horde-3.3.6-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2010-04-01 01:50:07 UTC
horde-3.3.6-1.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2010-04-01 17:20:16 UTC
horde-3.3.6-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2010-04-01 21:04:53 UTC
horde-3.3.6-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.