Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.

Upstream announcement for **version 1.3.3**

This is a security update to the stable version 1.3. It primarily fixes a recently discovered file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. More details will be published under CVE-2017-16651.

We strongly recommend to update all productive installations of Roundcube. Please do backup your data before updating!

**Changelog**

  - Fix decoding of mailto: links with + character in HTML     messages (#6020)

  - Fix false reporting of failed upgrade in installto.sh     (#6019)

  - Fix file disclosure vulnerability caused by insufficient     input validation **CVE-2017-16651** (#6026)

  - Fix mangled non-ASCII characters in links in HTML     messages (#6028)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers.

CVE-2017-16651 An authenticated attacker can take advantage of this flaw to read roundcube's configuration files by uploading a specially crafted file attachment.

For Debian 7 'Wheezy', these problems have been fixed in version 0.7.2-9+deb7u9.

We recommend that you upgrade your roundcube packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session.

A file disclosure vulnerability was discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers. An authenticated attacker can take advantage of this flaw to read roundcube's configuration files.

ID	Name	Product	Family	Severity
105977	Fedora 27 : roundcubemail (2017-cbc49efae8)	Nessus	Fedora Local Security Checks	high
104791	Debian DLA-1193-1 : roundcube security update	Nessus	Debian Local Security Checks	high
104688	Fedora 26 : roundcubemail (2017-1560290881)	Nessus	Fedora Local Security Checks	high
104508	FreeBSD : roundcube -- file disclosure vulnerability (f622608c-c53c-11e7-a633-009c02a2ab30)	Nessus	FreeBSD Local Security Checks	high
104486	Debian DSA-4030-1 : roundcube - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-16651

high

Tenable Plugins

high

high

high

high

high