Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.

Security fix for: Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0413 to the following vulnerability: Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0413 http://trac.roundcube.net/changeset/2245 http://www.securityfocus.com/bid/33372 http://secunia.com/advisories/33622 http://xforce.iss.net/xforce/xfdb/48129

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

Some vulnerabilities have been reported in RoundCube Webmail, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to conduct script insertion attacks and compromise a vulnerable system.

The HTML 'background' attribute within e.g. HTML emails is not properly sanitised before being used. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site if a malicious email is viewed.

Input passed via a vCard is not properly sanitised before being used in a call to 'preg_replace()' with the 'e' modifier in program/include/rcube_vcard.php. This can be exploited to inject and execute arbitrary PHP code by e.g. tricking a user into importing a malicious vCard file.

Upgrade to 0.2 stable Following security fix is included as well:
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-0413 to the following vulnerability: Cross-site scripting (XSS) vulnerability in RoundCube Webmail (roundcubemail) 0.2 stable allows remote attackers to inject arbitrary web script or HTML via the background attribute embedded in an HTML e-mail message. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0413 http://trac.roundcube.net/changeset/2245 http://www.securityfocus.com/bid/33372 http://secunia.com/advisories/33622 http://xforce.iss.net/xforce/xfdb/48129

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
37289	Fedora 10 : roundcubemail-0.2-7.stable.fc10 (2009-1204)	Nessus	Fedora Local Security Checks	medium
35935	FreeBSD : roundcube -- webmail script insertion and php code injection (35c0b572-125a-11de-a964-0030843d3802)	Nessus	FreeBSD Local Security Checks	medium
35594	Fedora 9 : roundcubemail-0.2-7.stable.fc9 (2009-1256)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-0413

medium

Tenable Plugins

medium

medium

medium