Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.

- Update to version 0.8.6 (bnc#812568)

  - Fix security issue in save-pref command (CVE-2013-1904)

A vulnerability has been found and corrected in roundcubemail :

A local file inclusion flaw was found in the way RoundCube Webmail, a browser-based multilingual IMAP client, performed validation of the 'generic_message_footer' value provided via web user interface in certain circumstances. A remote attacker could issue a specially crafted request that, when processed by RoundCube Webmail could allow an attacker to obtain arbitrary file on the system, accessible with the privileges of the user running RoundCube Webmail client (CVE-2013-1904).

The updated packages have been upgraded to the 0.8.6 version which is not affected by this issue.

RoundCube development team reports :

After getting reports about a possible vulnerability of Roundcube which allows an attacker to modify its users preferences in a way that he/she can then read files from the server, we now published updated packages as well as patches that fix this security issue.

Fix for local file inclusion via web UI modification of certain config options.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74974	openSUSE Security Update : roundcubemail (openSUSE-SU-2013:0671-1)	Nessus	SuSE Local Security Checks	medium
66186	Mandriva Linux Security Advisory : roundcubemail (MDVSA-2013:149)	Nessus	Mandriva Local Security Checks	medium
66170	FreeBSD : roundcube -- arbitrary file disclosure vulnerability (a592e991-a919-11e2-ade0-8c705af55518)	Nessus	FreeBSD Local Security Checks	medium
65835	Fedora 18 : roundcubemail-0.8.6-1.fc18 (2013-4564)	Nessus	Fedora Local Security Checks	medium
65833	Fedora 17 : roundcubemail-0.8.6-1.fc17 (2013-4536)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-1904

high

Tenable Plugins

medium

medium

medium

medium

medium