-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2009.1082
           New versions of Horde Application Framework/Groupware
                     resolve multiple vulnerabilities
                             15 September 2009

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Horde Application Framework
                      Horde Groupware Webmail Edition
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Overwrite Arbitrary Files       -- Remote with User Interaction
                      Cross-site Scripting            -- Remote/Unauthenticated      
Resolution:           Patch/Upgrade
Member content until: Thursday, October 15 2009

OVERVIEW

        New versions of the Horde Application Framework and Horde Groupware 
        Webmail Edition have been released fixing multiple security issues.


IMPACT

        The following announcements were made regarding these releases:
        
        o Horde Application Framework 3.2.5:
        
          "This is a major security release that fixes a vulnerability in the
           form library that allows overwriting of arbitrary local files with
           the permissions of the web server user. It also fixes two XSS
           vulnerabilities in the preference system and the MIME viewer library.
           The local file vulnerability can only be exploited when running an
           application that uses image form fields, like Turba H3 (2.3) or
           Ansel, and only by users who have write permissions to those
           applications" [1]
        
        o Horde Groupware Webmail Edition 1.1.6:
        
          "This is a major security release that fixes a vulnerability in the
           form library that allows overwriting of arbitrary local files with
           the permissions of the web server user. It also fixes two XSS
           vulnerabilities in the preference system and the MIME viewer
           library. The local file vulnerability can not be exploited with any
           application bundled with Horde Groupware Webmail Edition 1.1.x." [2]


MITIGATION

        The vendor recommends to upgrading to Horde Application Framework
        3.2.5 [1] and Horde Groupware Webmail Edition 1.1.6 [2] to
        resolve these issues.
        
        It is expected that other vendors which package this software will
        update soon.


REFERENCES

        [1] [announce] [SECURITY] Horde 3.2.5 (final)
            http://marc.info/?l=horde-announce&m=125291625030436&w=2

        [2] [announce] Horde Groupware Webmail Edition 1.1.6 (final)
            http://marc.info/?l=horde-announce&m=125292314007049&w=2

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFKruuTNVH5XJJInbgRAkyjAKCIwwgEXu+9Sg9T3p9uCxAY1KCKIgCfdmUM
8uQ8o4iU6iT4Hxe+TG+Pnq0=
=h/1a
-----END PGP SIGNATURE-----