Horde Mnemo Remote HTML Injection Vulnerabilities

Bugtraq ID:	15803
Class:	Input Validation Error
CVE:	CVE-2005-4190
Remote:	Yes
Local:	No
Published:	Dec 12 2005 12:00AM
Updated:	Jul 19 2006 07:37PM
Credit:	Discovered by Johannes Greil.
Vulnerable:	SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 7 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SuSE Suse Linux Enterprise Desktop 10 SuSE Linux Openexchange Server SuSE Linux Enterprise Server 9 SuSE Linux Desktop 1.0 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 7.3 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Database Server 0 S.u.S.E. Linux Connectivity Server Horde Project Mnemo 2.0.2 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:	Horde Project Mnemo 2.0.3

Horde Mnemo Remote HTML Injection Vulnerabilities

Mnemo is prone to multiple HTML-injection vulnerabilities.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing attackers to steal cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible.

Mnemo 2.0.2 and prior versions are affected by these issues.

Horde Mnemo Remote HTML Injection Vulnerabilities

An exploit is not required.

Horde Mnemo Remote HTML Injection Vulnerabilities

Solution:
The vendor has released an upgrade (Mnemo H3 2.0.3) dealing with this issue.

Please see the references for more information and vendor advisories.


Horde Project Mnemo 2.0.2

• Horde mnemo-h3-2.0.3.tar.gz
  ftp://ftp.horde.org/pub/mnemo/mnemo-h3-2.0.3.tar.gz

Horde Mnemo Remote HTML Injection Vulnerabilities

References:

• Mnemo H3 (2.0.3) (final) ([email protected])
  
• Mnemo Home Page (Horde Project)
  
• SEC Consult Security Advisory < 20051211-0 > (SEC-CONSULT)