Horde Nag Remote HTML Injection Vulnerabilities

Bugtraq ID:	15804
Class:	Input Validation Error
CVE:	CVE-2005-4190
Remote:	Yes
Local:	No
Published:	Dec 12 2005 12:00AM
Updated:	Mar 19 2015 09:16AM
Credit:	Discovered by Johannes Greil.
Vulnerable:	SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 + Linux kernel 2.4.21 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 7 + Linux kernel 2.4.19 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise Desktop 10 S.u.S.E. UnitedLinux 1.0 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SuSE Linux School Server for i386 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. SUSE CORE 9 for x86 S.u.S.E. Open-Enterprise-Server 9.0 S.u.S.E. Open-Enterprise-Server 1 S.u.S.E. Office Server S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 OSS S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 S.u.S.E. Linux Professional 8.2 S.u.S.E. Linux Professional 7.3 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.0 OSS S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Personal 8.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Openexchange Server S.u.S.E. Linux Office Server S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 1.0 S.u.S.E. Linux Database Server 0 Horde Turba Contact Manager 2.0.4 Horde Nag 2.0.3 Horde Nag 2.0.2 Horde Nag 2.0.1 Horde Nag 2.0 Horde Nag 1.1.3 Horde Nag 1.1.2 Horde Nag 1.1.1 Horde Nag 1.1 Horde Mnemo 2.0.2 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:	Horde Turba Contact Manager 2.0.5 Horde Nag 2.0.4 Horde Mnemo 2.0.3

Horde Nag Remote HTML Injection Vulnerabilities

Nag is prone to multiple HTML-injection vulnerabilities.

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing attackers to steal cookie-based authentication credentials. An attacker could also exploit these issues to control how the site is rendered to the user; other attacks are also possible.

Nag 2.0.3 and prior versions are affected by these issues.

Horde Nag Remote HTML Injection Vulnerabilities

An exploit is not required.

Horde Nag Remote HTML Injection Vulnerabilities

Solution:
The vendor has released an upgrade (Nag H3 2.0.4) dealing with this issue.

Please see the references for more information and vendor advisories.


Horde Nag 1.1

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 1.1.1

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 1.1.2

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 1.1.3

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 2.0

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 2.0.1

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Mnemo 2.0.2

• Horde mnemo-h3-2.0.3.tar.gz
  ftp://ftp.horde.org/pub/mnemo/mnemo-h3-2.0.3.tar.gz

Horde Nag 2.0.2

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Nag 2.0.3

• Horde nag-h3-2.0.4.tar.gz
  ftp://ftp.horde.org/pub/nag/nag-h3-2.0.4.tar.gz

Horde Turba Contact Manager 2.0.4

• Horde turba-h3-2.0.5.tar.gz
  http://ftp.horde.org/pub/turba/turba-h3-2.0.5.tar.gz

Horde Nag Remote HTML Injection Vulnerabilities

References:

• [announce] Nag H3 (2.0.4) (final) (Horde Project)
  
• Horde Advisory for Turba Vulnerabilities (Horde)
  
• Mnemo H3 (2.0.3) (final) ([email protected])
  
• Mnemo Home Page (Horde Project)
  
• Nag Home Page (Horde Project)
  
• SEC Consult Security Advisory < 20051211-0 > (SEC-CONSULT)
  
• Turba Contact Manager (Horde Project)