Detections
Analytics

Horde 3.3.12 open_calendar.js Backdoor

high Nessus Plugin ID 58010

Language:

Synopsis

A web application hosted on the remote host has a code execution vulnerability.

Description

A backdoored Horde release was detected on the remote host. The Horde FTP server was compromised, and backdoor code was added to allow arbitrary PHP execution. The backdoor reportedly was present in versions of Horde 3.3.12 downloaded between November 15, 2011 and February 7, 2012.

A remote, unauthenticated attacker could exploit this to execute arbitrary PHP.

Solution

Reinstall one of the clean software packages referenced in the Horde advisory for CVE-2012-0209.

See Also

http://www.nessus.org/u?fc71ca54

https://lists.horde.org/archives/announce/2012/000751.html

Plugin Details

Severity: High

ID: 58010

File Name: horde_open_calendar_backdoor.nasl

Version: 1.13

Type: remote

Family: CGI abuses

Published: 2/17/2012

Updated: 6/4/2024

Configuration: Enable thorough checks

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:horde:horde_application_framework

Required KB Items: www/horde

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/13/2012

Vulnerability Publication Date: 2/13/2012

Exploitable With

CANVAS (White_Phosphorus)

Metasploit (Horde 3.3.12 Backdoor Arbitrary PHP Code Execution)

Elliot (Horde RCE)

Reference Information

CVE: CVE-2012-0209

BID: 51989