oss-sec mailing list archives
Re: CVE-request: Roundcube XSS issues
From: Eygene Ryabinkin <rea-sec () codelabs ru>
Date: Sun, 26 Aug 2012 23:32:00 +0400
Mon, Aug 20, 2012 at 10:11:28AM -0600, Kurt Seifried wrote:
On 08/20/2012 05:24 AM, Jan Lieskovsky wrote:Upon code review, I don't think this issue affects 0.7.x versions, we ship in Fedora and EPEL (iilc the Larry skin was introduced only in 0.8.x version and in 0.7.x version the related code looks different).
That's true: the issue is that the $hkey was used in the ternary operator (copy'n'paste error) and $hkey wasn't initialized at the point, so the condition will be false, thus the 'show' mode will be used. And this code appears only in 0.8-beta and 0.8-rc. 0.8.0 fixes the issue and it doesn't exist in the 0.7.x, because there were no processing for the 'valueof' attribute in rcmail_message_headers().
I don't have filed RH bug for this based on the above. Could you have a look and confirm this?Please use CVE-2012-3507 for this issue.
At NVD I see that version specification is "prior to 0.8.0", http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3507 though http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-3507 shows only a stub without details. The proper version specification will be "Roundcube from 0.8.x series prior to 0.8.0". -- Eygene
Current thread:
- CVE-request: Roundcube XSS issues Henri Salo (Aug 20)
- Re: CVE-request: Roundcube XSS issues Henri Salo (Aug 20)
- Re: CVE-request: Roundcube XSS issues Hanno Böck (Aug 20)
- Re: CVE-request: Roundcube XSS issues Henri Salo (Aug 20)
- Re: CVE-request: Roundcube XSS issues Hanno Böck (Aug 20)
- Re: CVE-request: Roundcube XSS issues Kurt Seifried (Aug 20)
- Re: CVE-request: Roundcube XSS issues Steven M. Christey (Aug 24)
- Re: CVE-request: Roundcube XSS issues Eygene Ryabinkin (Aug 26)
- Re: CVE-request: Roundcube XSS issues Eygene Ryabinkin (Aug 26)
- Re: CVE-request: Roundcube XSS issues Steven M. Christey (Aug 24)
- Re: CVE-request: Roundcube XSS issues Henri Salo (Aug 20)