Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).

Upgrade to 3.3.6 - Fixes a lot of security bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3237     It has been discovered that horde3 is prone to     cross-site scripting attacks via crafted number     preferences or inline MIME text parts when using     text/plain as MIME type. For lenny this issue was     already fixed, but as an additional security precaution,     the display of inline text was disabled in the     configuration file.

  - CVE-2009-3701     It has been discovered that the horde3 administration     interface is prone to cross-site scripting attacks due     to the use of the PHP_SELF variable. This issue can only     be exploited by authenticated administrators.

  - CVE-2009-4363     It has been discovered that horde3 is prone to several     cross-site scripting attacks via crafted data:text/html     values in HTML messages.

This update of horde fixes :

  - CVE-2009-3236: CVSS v2 Base Score: 5.0: Overwrite     arbitrary files and execute PHP code

  - CVE-2009-3237: CVSS v2 Base Score: 5.0: Cross-Site     Scripting (XSS)

  - CVE-2009-3701: CVSS v2 Base Score: 4.3: Cross-Site     Scripting (XSS)

  - CVE-2009-4363: CVSS v2 Base Score: 4.3: Cross-Site     Scripting (XSS)

The remote host is affected by the vulnerability described in GLSA-200911-01 (Horde: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Horde:
    Stefan Esser of Sektion1 reported an error within the form library     when handling image form fields (CVE-2009-3236).
    Martin     Geisler and David Wharton reported that an error exists in the MIME     viewer library when viewing unknown text parts and the preferences     system in services/prefs.php when handling number preferences     (CVE-2009-3237).
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to     overwrite arbitrary files on the server, provided that the user has     write permissions. A remote authenticated attacker could conduct     Cross-Site Scripting attacks.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
47404	Fedora 13 : horde-3.3.6-1.fc13 (2010-5563)	Nessus	Fedora Local Security Checks	medium
47395	Fedora 12 : horde-3.3.6-1.fc12 (2010-5520)	Nessus	Fedora Local Security Checks	medium
47390	Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)	Nessus	Fedora Local Security Checks	medium
44831	Debian DSA-1966-1 : horde3 - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
44607	openSUSE Security Update : horde (horde-1947)	Nessus	SuSE Local Security Checks	medium
42415	GLSA-200911-01 : Horde: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2009-3237

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium