Horde arbitrary file inclusion vulnerability

[DerFalk]

What about a fix for Horde?

Look at this:
http://www.securityfocus.com/archive/1/489239/30/0/threaded

 

[breun]

It seems Horde 3.1.7 fixes this: http://lists.horde.org/archives/announce/2008/000382.html

 

[DerFalk]

ok, but what can we do now? This fix is for Horde "standalone", what about the "Plesk-IMP"?

 

[breun]

The link I posted also has links to patches against 3.1.6. Maybe you can modify them so they apply cleanly on psa-horde. Otherwise you'll just have to bug Parallels about it and/or wait for a Plesk update.

 

[tiramisu_]

a fix for 8.3 was requested from Plesk development, so waiting for reply

permanently in 8.4 only

 

[buddaaa]

The link I posted also has links to patches against 3.1.6. Maybe you can modify them so they apply cleanly on psa-horde. Otherwise you'll just have to bug Parallels about it and/or wait for a Plesk update.

is there any fix for horde 3.1.5 ? my plesk installation uses it:

# rpm -qa|grep horde
psa-horde-3.1.5-suse10.2.build83071218.20

 

[tiramisu_]

8.4 comes with 3.1.6

 

[tiramisu_]

should be available at the end of April

 

[breun]

8.4 comes with 3.1.6

All versions up to and including 3.1.6 seem to be vulnerable, so I hope that is a patched version of Horde 3.1.6.

 

[faris]

It is not clear to me if this requires the attacker to login using genuine credentials or if no authentication is required.

Can anyone enlighten me please?


The patch appears simple but I don't want to apply it in case it breaks the Plesk-modified version.


Faris.

 

[buddaaa]

8.4 comes with 3.1.6

so there is no fix right now ?

 

[atomicturtle]

If you're using ASL, this does not effect you.

 

[buddaaa]

If you're using ASL, this does not effect you.

no i don't use it. which feature protects against the bug ?

 

[DerFalk]

If you're using ASL, this does not effect you.

For me as a hobby-server-user it´s too expensive...

But you ASL-Guys do a great job!!!

 

[atomicturtle]

I believe the specific SQL injection rules that get it are 340013, and 340017. We've also got a virtual patch for it now, which doesnt have an ID number yet.

 

[Shazan]

It is not clear to me if this requires the attacker to login using genuine credentials or if no authentication is required.

Can anyone enlighten me please?


The patch appears simple but I don't want to apply it in case it breaks the Plesk-modified version.


Faris.

It requires valid user credentials -> http://secunia.com/advisories/29286/