bugtraq - Open-Xchange Security Advisory 2014-03-17

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <02361385-6735-4580-8A2E-5457D94A534A@open-xchange.com>
Date: Mon, 17 Mar 2014 10:13:54 +0100
From: Martin Braun <martin.braun@...n-xchange.com>
To: bugtraq@...urityfocus.com
Subject: Open-Xchange Security Advisory 2014-03-17

Product: Open-Xchange AppSuite
Vendor: Open-Xchange GmbH

Internal reference: 31065
Vulnerability type: Cross Site Scripting (CWE-80)
Vulnerable version: 7.4.1 and 7.4.2
Vulnerable component: frontend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.1-rev10, 7.4.2-rev8
Vendor notification: 2014-02-11
Solution date: 2014-02-28
Public disclosure: 2014-03-17
CVE reference: CVE-2014-2077
CVSSv2: 5.7 (AV:N/AC:M/Au:N/C:P/I:N/A:N/E:POC/RL:U/RC:C/CDP:LM/TD:H/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Script code that gets entered to the subject field of a mail, either by direct typing or using reply/forward, gets executed. This is caused by "aria" tags for screenreaders at the top bar, which do not use sanitized versions of the content. Note that just reading such a mail will not trigger the malicious code.

Risk:
Malicious script code can be executed within a users context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).

Solution:
Users should update to the latest patch releases. Users should avoid replying or forwarding mails from untrusted sources that contain suspicious subjects.

Internal reference: 31185 (Bug ID)
Vulnerability type: Information exposure (CWE-200)
Vulnerable version: 7.4.2
Vulnerable component: backend
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 7.4.2-rev9
Vendor notification: 2014-02-18
Solution date: 2014-02-26
Public disclosure: 2014-03-17
CVE reference: CVE-2014-2078
CVSSv2: 3.9 (AV:N/AC:L/Au:M/C:P/I:N/A:N/E:F/RL:U/RC:C/CDP:LM/TD:M/CR:ND/IR:ND/AR:ND)

Vulnerability Details:
Under some circumstances it may happen that E-Mail auto configuration for external accounts fails and returns an email address from a previously failing configuration attempt from any other user of the system.

Risk:
Users may gain unauthorised access to other users data e.g. mail addresses. Note that passwords are not affected by this.

Solution:
Users should update to the latest patch releases. As a temporary workaround, auto configuration for mail could be disabled at the backend:
$ /opt/open-xchange/sbin/stopbundle com.openexchange.mail.autoconfig.json