IMP Webmail Client 4.1.5, Horde Application Framework 3.1.5, and Horde Groupware Webmail Edition 1.0.3 does not validate unspecified HTTP requests, which allows remote attackers to (1) delete arbitrary e-mail messages via a modified numeric ID or (2) "purge" deleted emails via a crafted email message.

Version update to IMP 4.1.6 fixes a problem with validating HTTP requests that allowed attackers to delete emails (CVE-2007-6018) and some cross-site-scripting issues (CVE-2009-0930).

- Bug #428625 - CVE-2007-6018 horde: input validation     vulnerabilities

  - Bug #432027 - CVE-2008-0807 turba: insufficient access     checks

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora host is missing one or more security updates :

imp-4.1.6-1.fc7 :

  - Mon Jan 14 2008 Brandon Holbrook <fedora at     theholbrooks.org> 4.1.6-1

    - Upgraded to 4.1.6

    - Sat Oct 20 2007 Brandon Holbrook <fedora at       theholbrooks.org> 4.1.5-1

    - Upgraded to 4.1.5

horde-3.1.6-1.fc7 :

  - Fri Jan 11 2008 Brandon Holbrook <fedora at     theholbrooks.org> 3.1.6-1

    - Update to 3.1.6

    - Sat Oct 20 2007 Brandon Holbrook <fedora at       theholbrooks.org> 3.1.5-1

    - Update to 3.1.5

turba-2.1.7-1.fc7 :

  - Tue Feb 26 2008 Jan ONDREJ (SAL) <ondrejj(at)salstar.sk>     2.1.7-1

    - Update to upstream: CVE-2008-0807: turba: insufficient       access checks

    - Mon Jan 14 2008 Brandon Holbrook <fedora at       theholbrooks.org> 2.1.6-1

    - Upgraded to 2.1.6

    - Sat Oct 20 2007 Brandon Holbrook <fedora at       theholbrooks.org> 2.1.5-1

    - Upgraded to 2.1.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200802-03 (Horde IMP: Security bypass)

    Ulf Harnhammar, Secunia Research discovered that the 'frame' and     'frameset' HTML tags are not properly filtered out. He also reported     that certain HTTP requests are executed without being checked.
  Impact :

    A remote attacker could entice a user to open a specially crafted HTML     e-mail, possibly resulting in the deletion of arbitrary e-mail     messages.
  Workaround :

    There is no known workaround at this time.

Ulf Harnhammar discovered that the HTML filter of the Horde web application framework performed insufficient input sanitising, which may lead to the deletion of emails if a user is tricked into viewing a malformed email inside the Imp client.

This update also provides backported bugfixes to the cross-site scripting filter and the user management API from the latest Horde release 3.1.6.

The version of Horde Imp installed on the remote host suffers from a number of flaws.  A failure to sanitize user-supplied input could lead to a situation where an attacker can inject malicious HTML code or delete arbitrary email messages.

ID	Name	Product	Family	Severity
39991	openSUSE Security Update : imp (imp-659)	Nessus	SuSE Local Security Checks	medium
36006	openSUSE 10 Security Update : imp (imp-6101)	Nessus	SuSE Local Security Checks	medium
31317	Fedora 8 : horde-3.1.6-1.fc8 / imp-4.1.6-1.fc8 / turba-2.1.7-1.fc8 (2008-2087)	Nessus	Fedora Local Security Checks	medium
31311	Fedora 7 : horde-3.1.6-1.fc7 / imp-4.1.6-1.fc7 / turba-2.1.7-1.fc7 (2008-2040)	Nessus	Fedora Local Security Checks	medium
31033	GLSA-200802-03 : Horde IMP: Security bypass	Nessus	Gentoo Local Security Checks	medium
30062	Debian DSA-1470-1 : horde3 - missing input sanitising	Nessus	Debian Local Security Checks	medium
4338	Horde Imp < 4.1.6 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2007-6018

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium