[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20100524224949.Horde.3wqa7n8lhlkwsg00s4c8k4kc@bigworm.curecanti.org>
Date: Mon, 24 May 2010 22:49:49 -0600
From: Michael M Slusarz <slusarz@...de.org>
To: Max Olsterd <max.olsterd@...il.com>, oss-security@...ts.openwall.com,
security-2010@...irrelmail.org, security@...de.org
Subject: Re: [core] CVE Request for Horde and Squirrelmail
Quoting Max Olsterd <max.olsterd@...il.com>:
> Hi,
>
> Is there a CVE number available for the two 0-days exposed during Hack In
> The Box Dubai 2010 ?
>
> Though the exploits were not given during HITB (?), some friends have
> recently shown me that they found how both products (Squirrelmail and Horde)
> might be abused to be transformed, so that they become some kind of nmap
> scanner (banner grab, port scan, etc). It helps at discovering a remote DMZ,
> internal LAN, etc, by using those webmails as evil internal nmap proxies.
>
> More info available on the slides of the corporate hackers who found the
> 0-days :
> http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf
> -> Squirrelmail: page 69 (post auth vuln)
> -> Horde: page 74 (pre auth vuln)
Hi Max,
I don't believe there is a CVE number for this alleged "hack".
Additionally, we at the Horde project disagree entirely with the
characterization that this is an exploit. We have specifically warned
users for *at least 7 YEARS* that allowing the test scripts to remain
executable after using them is inadvisable (see
http://git.horde.org/diff.php/horde/docs/SECURITY?r1=1.1&r2=1.2?rt=horde). At
a minimum, it is a bit disingenuous for security researchers to
"announce" a exploit that is explicitly mentioned in the documentation
shipped with the software package.
That being said, with framework changes that have already been made in
Horde 4, test scripts are now globally disabled by default, which will
help protect somewhat against lazy administrators. Until then, for H3
admins simply need to disable/restrict the test scripts as we have
been telling them to do for years.
michael
--
___________________________________
Michael Slusarz [slusarz@...de.org]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
