Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain configurations, allows remote authenticated users to read and execute arbitrary files via ".." sequences and a null byte in the theme name.

This update of horde fixes the following vulnerabilities :

  - CVE-2008-1284: directory traversal allows authenticated     user to access and execute arbitrary files

  - CVE-2008-3330: remotely exploitable XSS

  - CVE-2008-3824: remotely exploitable XSS

The remote host is affected by the vulnerability described in GLSA-200805-01 (Horde Application Framework: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in the Horde Application     Framework:
    David Collins, Patrick Pelanne and the     HostGator.com LLC support team discovered that the theme preference     page does not sanitize POST variables for several options, allowing the     insertion of NULL bytes and '..' sequences (CVE-2008-1284).
    An     error exists in the Horde API allowing users to bypass security     restrictions.
  Impact :

    The first vulnerability can be exploited by a remote attacker to read     arbitrary files and by remote authenticated attackers to execute     arbitrary files. The second vulnerability can be exploited by     authenticated remote attackers to perform restricted operations.
  Workaround :

    There is no known workaround at this time.

It was discovered that the Horde web application framework permits arbitrary file inclusion by a remote attacker through the theme preference parameter.

Fix arbitrary file inclusion through abuse of the theme preference.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
39984	openSUSE Security Update : horde (horde-311)	Nessus	SuSE Local Security Checks	medium
34959	openSUSE 10 Security Update : horde (horde-5791)	Nessus	SuSE Local Security Checks	medium
32149	GLSA-200805-01 : Horde Application Framework: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
31590	Debian DSA-1519-1 : horde3 - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
31431	Fedora 7 : horde-3.1.7-1.fc7 (2008-2406)	Nessus	Fedora Local Security Checks	medium
31429	Fedora 8 : horde-3.1.7-1.fc8 (2008-2362)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-1284

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium