BID:10895

PHPGroupWare Plaintext Cookie Authentication Credentials Information Disclosure Vulnerability

Info

PHPGroupWare Plaintext Cookie Authentication Credentials Information Disclosure Vulnerability

Bugtraq ID:	10895
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 09 2004 12:00AM
Updated:	Aug 09 2004 12:00AM
Credit:	This issue was reported by the vendor.
Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16 RC1 PHPGroupWare PHPGroupWare 0.9.16 .000 PHPGroupWare PHPGroupWare 0.9.14 .007 PHPGroupWare PHPGroupWare 0.9.14 .006 PHPGroupWare PHPGroupWare 0.9.14 .005 PHPGroupWare PHPGroupWare 0.9.14 .003 PHPGroupWare PHPGroupWare 0.9.13 - Debian Linux 2.2 PHPGroupWare PHPGroupWare 0.9.12 - MySQL AB MySQL 3.23.36 - MySQL AB MySQL 3.23.34 - MySQL AB MySQL 3.23.31 - PostgreSQL PostgreSQL 6.5.3 - PostgreSQL PostgreSQL 6.3.2

Not Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16 .002

Discussion

PHPGroupWare Plaintext Cookie Authentication Credentials Information Disclosure Vulnerability

PHPGroupWare is a freely available, open source groupware system written in PHP. It is distributed and maintained by the PHPGroupWare project.

PHPGroupWare is reported to contain a plaintext cookie authentication credentials information disclosure vulnerability.

If the web administration of PHPGroupWare is not conducted over an encrypted link, an attacker with the ability to sniff network traffic could easily retrieve these passwords. This may aid the attacker in further system compromise.

Versions prior to 0.9.16.002 are reported susceptible to this vulnerability.

Exploit / POC

PHPGroupWare Plaintext Cookie Authentication Credentials Information Disclosure Vulnerability

An exploit is not required.

Solution / Fix

PHPGroupWare Plaintext Cookie Authentication Credentials Information Disclosure Vulnerability

Solution:
The vendor has released version 0.9.16.002 addressing this issue.

PHPGroupWare PHPGroupWare 0.9.12