![oss-sec logo](/images/oss-sec-logo.png)
oss-sec mailing list archives
Re: horde webmail edition < 1.1.1
From: Nico Golde <oss-security+ml () ngolde de>
Date: Sat, 16 Aug 2008 16:05:28 +0200
Hi Steven, * Steven M. Christey <coley () linus mitre org> [2008-08-15 01:23]:
On Wed, 13 Aug 2008, Tomas Hoger wrote:On Wed, 13 Aug 2008 14:00:03 +0200 Nico Golde <oss-security+ml () ngolde de> wrote:This should be a duplicate of CVE-2008-3330.Actually, (1) is covered by CVE-2008-3330, (2) probably never got an id. Bit more info on (2) here: https://bugzilla.redhat.com/show_bug.cgi?id=452549 Steven, can you please correct CVE description. Thanks!Hmm, actually I thought this would have been added after my post on: http://www.openwall.com/lists/oss-security/2008/07/28/3 which already mentions this.Ah, so actually both issue were previously mentioned here... I forgot. It seems that after you pointed out (2), no more CVE id was allocated in that thread.OK, some followups: 1) CVE-2008-3330.2, for Turba, affects contact.php, which only exists in Turba 2.2.
Yes
2) The Debian bug report seems to have found contact issues in Turba 2.1, in browse.php: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492578#40
Yes, the one mentioned in http://www.openwall.com/lists/oss-security/2008/07/28/3.
3) The code from Turba 2.1 looks quite different than the contact.php code as quoted by Nico here: http://www.openwall.com/lists/oss-security/2008/07/28/3
That's because Turba 2.1 is not affected, 2.2 is. The file and the vulnerable code doesn't exist.
4) I haven't seen any mention of contact issues in Horde itself, is this correct?
Not really. Well, the issue is the same except that it's present in different source files. So there is no contact handling and the obrowser thing in horde, it's one piece of code to manage contacts in obrowser.
5) CVE-2008-3650, the "unspecified" issues based on a vague Horde Groupware advisory, appears to line up closely with both CVE-2008-3330.1 (obrowser) and CVE-2008-3330.2 (Turba contacts). Is this sufficiently confirmed?
Yes, I already had contact to upstream and our maintainer before asking for a CVE id. Kind regards Nico -- Nico Golde - http://www.ngolde.de - nion () jabber ccc de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
Attachment:
_bin
Description:
Current thread:
- horde webmail edition < 1.1.1 Hanno Böck (Aug 12)
- Re: horde webmail edition < 1.1.1 Steven M. Christey (Aug 12)
- Re: horde webmail edition < 1.1.1 Nico Golde (Aug 13)
- Re: horde webmail edition < 1.1.1 Tomas Hoger (Aug 13)
- Re: horde webmail edition < 1.1.1 Nico Golde (Aug 13)
- Re: horde webmail edition < 1.1.1 Tomas Hoger (Aug 13)
- Re: horde webmail edition < 1.1.1 Steven M. Christey (Aug 14)
- Re: horde webmail edition < 1.1.1 Nico Golde (Aug 16)
- Re: horde webmail edition < 1.1.1 Nico Golde (Aug 13)
- Re: horde webmail edition < 1.1.1 Steven M. Christey (Aug 12)