PHPGroupWare Main Screen Message Script Injection Vulnerability

Bugtraq ID:	14724
Class:	Input Validation Error
CVE:	CVE-2005-2761
Remote:	Yes
Local:	No
Published:	Aug 25 2005 12:00AM
Updated:	Jul 12 2009 05:06PM
Credit:	Announced by the vendor.
Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16 RC3 PHPGroupWare PHPGroupWare 0.9.16 RC2 PHPGroupWare PHPGroupWare 0.9.16 RC1 PHPGroupWare PHPGroupWare 0.9.16 .006 PHPGroupWare PHPGroupWare 0.9.16 .005 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 alpha + Debian Linux 3.1 PHPGroupWare PHPGroupWare 0.9.16 .003 + Gentoo Linux PHPGroupWare PHPGroupWare 0.9.16 .002 PHPGroupWare PHPGroupWare 0.9.16 .000 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:	PHPGroupWare PHPGroupWare 0.9.16 .007

PHPGroupWare Main Screen Message Script Injection Vulnerability

PHPGroupWare is prone to a script injection vulnerability. A malicious admin user can inject script code into the main screen message of the site.

PHPGroupWare Main Screen Message Script Injection Vulnerability

An exploit is not required.

PHPGroupWare Main Screen Message Script Injection Vulnerability

Solution:
Debian has released advisory DSA 798-1 and fixes to address this issue. Please see the referenced advisory for further information.

This issue was addressed in PHPGroupWare 0.9.16.007.


PHPGroupWare PHPGroupWare 0.9.16 .006

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 RC1

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 .005

• Debian phpgroupware-addressbook_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-addressbook_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-admin_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-admin_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-bookmarks_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-bookmarks_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-calendar_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-calendar_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-chat_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-chat_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-comic_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-comic_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-core_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-core_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-developer-tools_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-developer-tools_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-dj_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-dj_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-eldaptir_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-eldaptir_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-email_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-email_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-etemplate_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-etemplate_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-felamimail_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-felamimail_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-filemanager_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-filemanager_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-folders_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-folders_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-forum_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-forum_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-ftp_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-ftp_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-fudforum_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-fudforum_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-headlines_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-headlines_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-hr_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-hr_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-infolog_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-infolog_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-manual_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-manual_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-messenger_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-messenger_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-news-admin_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-news-admin_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-nntp_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-nntp_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-notes_0.9.16.005-3.sarge0_all.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-notes_0.9.16.005-3.sarge0_all.deb


• Debian phpgroupware-notes_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-notes_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-phonelog_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phonelog_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-phpbrain_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpbrain_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-phpgwapi_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpgwapi_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-phpsysinfo_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-phpsysinfo_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-polls_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-polls_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-preferences_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-preferences_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-projects_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-projects_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-qmailldap_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-qmailldap_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-registration_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-registration_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-setup_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-setup_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-sitemgr_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-sitemgr_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-skel_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-skel_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-soap_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-soap_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-stocks_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-stocks_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-todo_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-todo_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-tts_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-tts_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-wiki_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-wiki_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware-xmlrpc_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re-xmlrpc_0.9.16.005-3.sarge2_all.deb


• Debian phpgroupware_0.9.16.005-3.sarge2_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/p/phpgroupware/phpgroupwa re_0.9.16.005-3.sarge2_all.deb


• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 RC3

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 .002

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 .000

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 RC2

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare PHPGroupWare 0.9.16 .003

• PhPGroupWare phpgroupware-0.9.16.007.tar.gz
  http://prdownloads.sourceforge.net/phpgroupware/phpgroupware-0.9.16.00 7.tar.gz

PHPGroupWare Main Screen Message Script Injection Vulnerability

References:

• bug #13863 overview: Main screen message allows for potential security risk (PHPGroupWare)