Re: CVE id request: horde3/turba2

[Nico Golde <oss-security+ml () ngolde de>]

Hi Tomas,
* Tomas Hoger <thoger () redhat com> [2008-07-28 10:53]:
> On Sun, 27 Jul 2008 17:57:05 -0400 (EDT) "Steven M. Christey"
> <coley () linus mitre org> wrote:
> > Name: CVE-2008-3330
> > Cross-site scripting (XSS) vulnerability in
> > services/obrowser/index.php in Horde 3.2 and Turba 2.2 allows remote
> > attackers to inject arbitrary web script or HTML via the contact name.
>
> Why does this mention Turba?  Affected script does not seem to be part
> of Turba, at least not part of Fedora packages.

In turba the affected file is src/contact.php:
Index: turba/contact.php
===================================================================
RCS file: /repository/turba/contact.php,v
retrieving revision 1.11
diff -u -r1.11 contact.php
--- turba/contact.php   5 May 2008 05:14:12 -0000       1.11
+++ turba/contact.php   13 Jun 2008 21:37:43 -0000
@@ -103,7 +103,7 @@
 if (!$print_view) {
     echo $tabs->render($viewName);
 }
-echo '<h1 class="header">' . ($contact->getValue('name') ? $contact->getValue('name') : '<em>' . _("Blank name") . 
'</em>') . '</h1>';
+echo '<h1 class="header">' . ($contact->getValue('name') ? htmlspecialchars($contact->getValue('name')) : '<em>' . 
_("Blank name") . '</em>') . '</h1>';
 $view->html();
 echo '</div>';
 require $registry->get('templates', 'horde') . '/common-footer.inc';

Turba 2.1 was not affected, this file is new in 2.2
and the old code did escape the title.

> Btw, this seems to be an issue fixed by upstream mid-June in horde
> 3.1.8 and 3.2.1 (and other Horde suites that include Horde Framework +
> some other components in all-in-one suite), see following bug for
> further references:
>
>   https://bugzilla.redhat.com/show_bug.cgi?id=452539

Yes this information seems to be correct to me.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: