SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
IT News
Search
SecurityAlert Database
About SecurityAlert
ExploitAlert Database
SecurityReason Research
WLB
WLB Database
Send to WLB
About WLB
Services
Security Audit
Schedule
Prices of services
Contact
RSS
SecurityReason IT News
SecurityAlert
World Laboratory of Bugtraq
ExploitAlert
Apache
PHP
Corporate
Contact
About SecurityReason
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com
Home arrow SecurityAlert Database

Arrow  Topic :

Horde, Popoon frameworks common inputsanitization errors (XSS)


Arrow  SecurityAlert : 4245
Arrow  CVE : CVE-2008-3823
Arrow  CVE : CVE-2008-3824
Arrow  CWE : CWE-79
Arrow  SecurityRisk : Low  Security Risk Low  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Victim interaction required : Yes
Arrow  Exploit Available : No
Arrow  Credit : Will Drewry
Arrow  Published : 15.09.2008

Arrow  Affected Software : horde:horde:3.2.1 and previous versions
horde:horde:3.2



Arrow  Advisory Content :  

#2008-012 Horde, Popoon frameworks common input sanitization errors (XSS)

Two cross-site scripting (XSS) vulnerabilities were reported in Horde
Framework. The first of which is that the Horde framework fails to
properly
sanitize the filename of MIME attachments on received emails. The second
vulnerability has a wider impact.

Horde relies on code similar to Popoon\'s externalinput.php to filter out
potential XSS attacks on user-supplied input. This filter, and the
original,
fail to fully sanitize user data. In particular, this filter fails to
protect against \'/\'s acting as spaces in both Microsoft Internet Explorer
and
Mozilla Firefox.

Patches have been made available for Horde:

* 3.1:
http://ocert.org/patches/2008-012/Text_Filter.31.patch
* 3.2 - CVS HEAD:
http://ocert.org/patches/2008-012/MIME.patch
http://ocert.org/patches/2008-012/Text_Filter.patch

A replacement for externalinput.php is linked below as well.

Affected version:

Popoon (externalinput.php) <= r22196

Horde >= 3.2, <= 3.2.1 (both issues)
Horde >= 3.1, < 3.2 (XSS filter only)

(secondary affected versions)

Horde Groupware >= 1.0, <= 1.0.6 (XSS filter only)
Horde Groupware Webmail Edition >= 1.0, <= 1.0.7 (XSS filter only)
Horde Groupware >= 1.1, <= 1.1.2 (both issues)
Horde Groupware Webmail Edition >= 1.1, <= 1.1.2 (both issues)
Cake-PHP <= 1.2.0.7296 RC2
phpMyFAQ <= 2.5.0-dev (2008-08-18)
deluxeBB <= 1.2
emucms <= 0.3
SimpleSite <= 1.6.4
RevokeBB <= 1.0RC11_normal
TPLN <= 2.9
Logicoder <= r27
phour <= r106
MDPro <= 1.0821
noserub <= r784/0.6

Fixed version:

Horde > 3.2.1 (see patches)

externalinput/clean.php (see links)

Credit: Vulnerability report and proof of concepts received from
Alexios Fakos <security [at] nruns [dot] com>.

CVE: CVE-2008-3823 (MIME attachment), CVE-2008-3824 (XSS filtering)

Timeline:
2008-08-05: initial report and proof of concepts received.
2008-08-18: affected software survey completed by oCERT.
2008-08-18: externalinput.php/Popoon author contacted.
2008-08-19: Horde author contacted.
2008-08-19: initial patches for Horde and Popoon supplied by vendors.
2008-08-19: reporter calls out additional possible vectors in
externalinput.php.
2008-08-20: secondary fixed for externalinput.php supplied.
2008-08-20: attempted to contact CakePHP.
2008-09-04: final Horde patches supplied.
2008-09-04: potentially affected oCERT members and vendor-sec notified.
2008-08-05: CVEs assigned.
2008-09-05: oCERT requests end of embargo to be Sep 10, 1700 UTC.
2008-09-06: contacted phlymail lite; confirmed unaffected.
2008-09-06: notified all secondary vendors above.
2008-09-06: acknowledgement from cakephp, noserub, phpmyfaq.
2008-09-09: confirmed exact embargo end with vendor-sec and other vendors.
2008-09-10: advisory released.

References:
http://blog.liip.ch/archive/2005/01/16/xss-how-we-try-to-prevent-it.html

http://blog.liip.ch/missed-case-in-externalinput-php-resulting-in-viable
-xss-attacks.html

Links:
http://horde.org
http://svn.bitflux.ch/repos/public/popoon/trunk/classes/externalinput.ph
p
https://svn.liip.ch/repos/public/ext/externalinput/trunk/lx/externalinpu
t/clean.php
http://horde.org/groupware
http://www.cakephp.org
http://www.phpmyfaq.de
http://www.deluxebb.com
http://www.emusoft.org/index.php?page=category&cat_id=14
http://dev.mistralys.com/SimpleSite
http://sourceforge.net/projects/revokebb
http://tpln.h2lsoft.com/
http://code.google.com/p/logicoder/
http://code.google.com/p/phour/
http://www.maxdev.com/AboutMD.phtml
http://code.google.com/p/noserub/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3823
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3824

Permalink:
http://www.ocert.org.org/advisories/ocert-2008-012.html

--
Will Drewry <redpig (at) ocert (dot) org [email concealed]>
oCERT Team :: http://ocert.org



Arrow  References :

http://www.securityfocus.com/archive/1/archive/1/496182/100/0/threaded
http://www.openwall.com/lists/oss-security/2008/09/10/1
http://ocert.org/patches/2008-012/MIME.patch
http://marc.info/?l=horde-announce&amp;m=122104360019867&amp;w=2
http://xforce.iss.net/xforce/xfdb/45030
http://www.securityfocus.com/bid/31110
http://www.ocert.org/advisories/ocert-2008-012.html
http://secunia.com/advisories/31842




Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...
Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration
PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass
Copyright © SecurityReason.com. All Rights Reserved.