[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <559A726C.9060904@suse.de>
Date: Mon, 6 Jul 2015 14:19:56 +0200
From: Andreas Stieger <astieger@...e.de>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE request for vulnerabilities fixed in roundcubemail 1.1.2 and
1.0.6
Hello,
I am requesting CVE identifiers for the three vulnerabilities fixed in
roundcubemail 1.1.2 and 1.0.6. Quotes shortened for brevity and relevance:
From https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released/
> The security-related fixes in particular are:
> * XSS vulnerability in _mbox argument
Fix XSS vulnerability in _mbox argument handling (#1490417
<http://trac.roundcube.net/ticket/1490417>)
http://trac.roundcube.net/ticket/1490417
The XSS-vulnerability can be triggered by appending malicious script
code to the _mbox-parameter. The following example will pop an alert box:
https://{YOURSERVER}/?_task=mail&_mbox=INBOX%22%3E%3Cscript%3Ealert(%22Roundcube+v1.1.1+XSS%22)%3C%2Fscript%3E
<https://%7BYOURSERVER%7D/?_task=mail&_mbox=INBOX%22%3E%3Cscript%3Ealert%28%22Roundcube+v1.1.1+XSS%22%29%3C%2Fscript%3E>
Attackers could use this vulnerability to steal cookies or extract
email-content.
Commit:
1.1: http://trac.roundcube.net/changeset/b782815dac/github
Not claimed to affect 1.0.
> * security improvement in contact photo handling
Fix security issue in contact photo handling (#1490379
<http://trac.roundcube.net/ticket/1490379>)
http://trac.roundcube.net/ticket/1490379
There is a potential for an arbitrary read from an authenticated user
who uploads a contact (vCard) with a specially crafted POST.
[...]
by supplying the "_alt" param in the POST. User must be authenticated.
[...]
I was able to read any file on disk (the apache has access to, e.g.
config/config.inc.php) using GET request
Commits:
1.1: http://trac.roundcube.net/changeset/681ba6fc3/github
1.0: http://trac.roundcube.net/changeset/6ccd4c54b/github
> * potential info disclosure from temp directory
Fix potential info disclosure issue by protecting directory access
(#1490378 <http://trac.roundcube.net/ticket/1490378>)
http://trac.roundcube.net/ticket/1490378
The logs directory is not protected from browsing. Most log entries are
not bad, but one became evident on my host that was pretty nasty.
It looked like the following:
[25-Apr-2015 04:03:11 -0400]: <ijpv9kqo> DB Error: [1062] Duplicate entry 'ijpv9kqofvpksxxxxxxxxxxxx' for key 'PRIMARY' (SQL Query: INSERT INTO `session` (`sess_id`, `vars`, `ip`, `created`, `changed`) VALUES ('ijpv9kqofvpksxxxxxxxx', 'xxxxxxxxxxxxxxxxxxxxxxx=', '108.61.90.131', now(), now())) in /var/www/html/roundcubemail-1.1.1/program/lib/Roundcube/rcube_db.php on line 543 (POST /roundcubemail-1.1.1/?_task=mail&_action=refresh?_task=&_action=)
I obfuscated the sensitive fields, but this would be enough for a
non-credential user to view the file (via the webroot/logs/errors file),
and then replace their own cookies with the entry from above to log in
as a user that was listed there.
This seems to be a very rare occurrence, but considering that other
SQL/other actions might report other sensitive data into this file, it
might be worth automatically protecting this directory with an .htaccess
file, or prepending a php tag to avoid overt reading by any
unauthenticated user.
Commits:
http://trac.roundcube.net/changeset/012555c1c/github
1.1: http://trac.roundcube.net/changeset/16640c7fb0c8/github
Not claimed to affect 1.0.
Thanks,
Andreas
--
Andreas Stieger <astieger@...e.de>
Project Manager Security
SUSE Linux GmbH, GF: Felix Imendörffer, Jane Smithard, Dilip Upmanyu, Graham Norton, HRB 21284 (AG Nürnberg)
Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
