Debian Horde Default Administrator Password Vulnerability

Bugtraq ID:	15337
Class:	Design Error
CVE:	CVE-2005-3344
Remote:	Yes
Local:	No
Published:	Nov 07 2005 12:00AM
Updated:	Nov 07 2005 12:00AM
Credit:	Mike O'Connor is credited with the discovery of this vulnerability. This issue was announced in the referenced Debian advisory.
Vulnerable:	Debian horde 3.0.4 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1
Not Vulnerable:

Debian Horde Default Administrator Password Vulnerability

The default Horde3 installation for Debian has a blank administrator password.

A local or remote attacker can exploit this vulnerability to gain administrative access to the affected application. This may aid an attacker in further attacks against the underlying system; other attacks are also possible.

This issue is specific to Debian Linux installations of the Horde3 application.

Debian Horde Default Administrator Password Vulnerability

No exploit is required.

Debian Horde Default Administrator Password Vulnerability

Solution:
Debian Linux has released security advisory DSA 884-1 with fixes addressing this issue. Please see the referenced advisory for further information.


Debian horde 3.0.4

• Debian horde3_3.0.4-4sarge1_all.deb
  http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sa rge1_all.deb

Debian Horde Default Administrator Password Vulnerability

References:

• Pandora Homepage (Pandora FMS Team)