FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter.

Several vulnerabilities have been discovered in egroupware, a web-based groupware suite. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2005-0870     Maksymilian Arciemowicz discovered several cross site     scripting problems in phpsysinfo, which are also present     in the imported version in egroupware and of which not     all were fixed in DSA 724.

  - CVE-2005-2600     Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in egroupware and allows     remote attackers to read private posts via a modified     mid parameter.

  - CVE-2005-3347     Christopher Kunz discovered that local variables get     overwritten unconditionally in phpsysinfo, which are     also present in egroupware, and are trusted later, which     could lead to the inclusion of arbitrary files.

  - CVE-2005-3348     Christopher Kunz discovered that user-supplied input is     used unsanitised in phpsysinfo and imported in     egroupware, causing a HTTP Response splitting problem.

The remote host is affected by the vulnerability described in GLSA-200508-20 (phpGroupWare: Multiple vulnerabilities)

    phpGroupWare improperly validates the 'mid' parameter retrieved     via a forum post. The current version of phpGroupWare also adds several     safeguards to prevent XSS issues, and disables the use of a potentially     vulnerable XML-RPC library.
  Impact :

    A remote attacker may leverage the XML-RPC vulnerability to     execute arbitrary PHP script code. He could also create a specially     crafted request that will reveal private posts.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in phpgroupware, a web-based groupware system written in PHP. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-2498     Stefan Esser discovered another vulnerability in the     XML-RPC libraries that allows injection of arbitrary PHP     code into eval() statements. The XMLRPC component has     been disabled.

  - CAN-2005-2600

    Alexander Heidenreich discovered a cross-site scripting     problem in the tree view of FUD Forum Bulletin Board     Software, which is also present in phpgroupware.

  - CAN-2005-2761

    A global cross-site scripting fix has also been included     that protects against potential malicious scripts     embedded in CSS and xmlns in various parts of the     application and modules.

This update also contains a postinst bugfix that has been approved for the next update to the stable release.

ID	Name	Product	Family	Severity
22765	Debian DSA-899-1 : egroupware - programming errors	Nessus	Debian Local Security Checks	medium
19573	GLSA-200508-20 : phpGroupWare: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
19568	Debian DSA-798-1 : phpgroupware - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2600

high

Tenable Plugins

medium

medium

medium