Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.

Updated zarafa packages fix security vulnerabilities :

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).

Fixed multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448 and CVE-2014-5449)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
77839	Mandriva Linux Security Advisory : zarafa (MDVSA-2014:182)	Nessus	Mandriva Local Security Checks	low
77484	Fedora 19 : zarafa-7.1.10-4.fc19 (2014-9768)	Nessus	Fedora Local Security Checks	medium
77450	Fedora 20 : zarafa-7.1.10-4.fc20 (2014-9754)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-5448

medium

Tenable Plugins

low

medium

medium