The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.

Upgrade to 3.3.6 - Fixes a lot of security bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Stefan Esser discovered that Horde, a web application framework providing classes for dealing with preferences, compression, browser detection, connection tracking, MIME, and more, is insufficiently validating and escaping user provided input. The Horde_Form_Type_image form element allows to reuse a temporary filename on reuploads which are stored in a hidden HTML field and then trusted without prior validation. An attacker can use this to overwrite arbitrary files on the system or to upload PHP code and thus execute arbitrary code with the rights of the webserver.

This update of horde fixes :

  - CVE-2009-3236: CVSS v2 Base Score: 5.0: Overwrite     arbitrary files and execute PHP code

  - CVE-2009-3237: CVSS v2 Base Score: 5.0: Cross-Site     Scripting (XSS)

  - CVE-2009-3701: CVSS v2 Base Score: 4.3: Cross-Site     Scripting (XSS)

  - CVE-2009-4363: CVSS v2 Base Score: 4.3: Cross-Site     Scripting (XSS)

The remote host is affected by the vulnerability described in GLSA-200911-01 (Horde: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Horde:
    Stefan Esser of Sektion1 reported an error within the form library     when handling image form fields (CVE-2009-3236).
    Martin     Geisler and David Wharton reported that an error exists in the MIME     viewer library when viewing unknown text parts and the preferences     system in services/prefs.php when handling number preferences     (CVE-2009-3237).
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to     overwrite arbitrary files on the server, provided that the user has     write permissions. A remote authenticated attacker could conduct     Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
47404	Fedora 13 : horde-3.3.6-1.fc13 (2010-5563)	Nessus	Fedora Local Security Checks	medium
47395	Fedora 12 : horde-3.3.6-1.fc12 (2010-5520)	Nessus	Fedora Local Security Checks	medium
47390	Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)	Nessus	Fedora Local Security Checks	medium
44762	Debian DSA-1897-1 : horde3 - insufficient input sanitization	Nessus	Debian Local Security Checks	medium
44607	openSUSE Security Update : horde (horde-1947)	Nessus	SuSE Local Security Checks	medium
42415	GLSA-200911-01 : Horde: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2009-3236

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium