Re: horde webmail edition < 1.1.1

[Nico Golde <oss-security+ml () ngolde de>]

Hi Steven,
* Steven M. Christey <coley () linus mitre org> [2008-08-15 01:23]:
> On Wed, 13 Aug 2008, Tomas Hoger wrote:
> > On Wed, 13 Aug 2008 14:00:03 +0200 Nico Golde
> > <oss-security+ml () ngolde de> wrote:
> > > > > This should be a duplicate of CVE-2008-3330.
> > > >
> > > > Actually, (1) is covered by CVE-2008-3330, (2) probably never got an
> > > > id.  Bit more info on (2) here:
> > > >
> > > >   https://bugzilla.redhat.com/show_bug.cgi?id=452549
> > > >
> > > > Steven, can you please correct CVE description.  Thanks!
> > >
> > > Hmm, actually I thought this would have been added after my
> > > post on:
> > > http://www.openwall.com/lists/oss-security/2008/07/28/3
> > > which already mentions this.
> >
> > Ah, so actually both issue were previously mentioned here... I forgot.
> > It seems that after you pointed out (2), no more CVE id was allocated
> > in that thread.
>
> OK, some followups:
>
> 1) CVE-2008-3330.2, for Turba, affects contact.php, which only exists in
>    Turba 2.2.

Yes

> 2) The Debian bug report seems to have found contact issues in Turba 2.1,
>    in browse.php:
>    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492578#40

Yes, the one mentioned in 
http://www.openwall.com/lists/oss-security/2008/07/28/3.

> 3) The code from Turba 2.1 looks quite different than the contact.php code
>    as quoted by Nico here:
>
>     http://www.openwall.com/lists/oss-security/2008/07/28/3

That's because Turba 2.1 is not affected, 2.2 is. The file and the 
vulnerable code doesn't exist.
 
> 4) I haven't seen any mention of contact issues in Horde itself, is this
>    correct?

Not really. Well, the issue is the same except that it's 
present in different source files. So there is no contact 
handling and the obrowser thing in horde, it's one piece of 
code to manage contacts in obrowser.

> 5) CVE-2008-3650, the "unspecified" issues based on a vague Horde
>    Groupware advisory, appears to line up closely with both
>    CVE-2008-3330.1 (obrowser) and CVE-2008-3330.2 (Turba contacts).  Is
>    this sufficiently confirmed?

Yes, I already had contact to upstream and our maintainer 
before asking for a CVE id.

Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Attachment: _bin
Description: