Horde IMP and Groupware Webmail Cached PGP Key Spoofing Vulnerability

Bugtraq ID:	34598
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 20 2009 12:00AM
Updated:	Apr 20 2009 12:00AM
Credit:	Peter Meier
Vulnerable:	Horde Project IMP 4.3.3 Horde Project IMP 4.3.2 Horde Project IMP 4.2.2 Horde Project IMP 4.2.1 Horde Project IMP 4.1.5 Horde Project IMP 4.1.4 Horde Project IMP 4.0.4 Horde Project IMP 4.0.3 Horde Project IMP 4.0.2 Horde Project IMP 4.0.1 Horde Project IMP 4.0 Horde Project IMP 3.2.6 Horde Project IMP 3.2.5 Horde Project IMP 3.2.4 Horde Project IMP 3.2.3 Horde Project IMP 3.2.2 Horde Project IMP 3.2.1 Horde Project IMP 3.2 Horde Project IMP 3.1.2 Horde Project IMP 3.1 Horde Project IMP 3.0 Horde Project IMP 2.3.6 Horde Project IMP 2.3 Horde Project IMP 2.2.8 + Horde Project Horde 1.2.8 Horde Project IMP 2.2.7 - Caldera OpenLinux Server 3.1.1 - Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.7 Horde Project IMP 2.2.6 - Debian Linux 2.2 + Horde Project Horde 1.2.6 Horde Project IMP 2.2.5 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.5 Horde Project IMP 2.2.4 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.4 Horde Project IMP 2.2.3 + Horde Project Horde 1.2.3 Horde Project IMP 2.2.2 + Horde Project Horde 1.2.2 Horde Project IMP 2.2.1 + Horde Project Horde 1.2.1 Horde Project IMP 2.2 + Horde Project Horde 1.2 Horde Project IMP 2.0.9 Horde Project IMP 2.0.8 Horde Project IMP 2.0.8 Horde Project IMP 2.0 - PHP PHP 4.0.1 pl2 - PHP PHP 4.0.1 - PHP PHP 4.0 0 - PHP PHP 3.0.16 Horde Project Groupware Webmail Edition 1.2.2 Horde Project Groupware Webmail Edition 1.2.1 Horde Project Groupware Webmail Edition 1.1.4 Horde Project Groupware Webmail Edition 1.1.3 Horde Project Groupware Webmail Edition 1.1.3 Horde Project Groupware Webmail Edition 1.1.2 Horde Project Groupware Webmail Edition 1.1.1 Horde Project Groupware Webmail Edition 1.2 Horde Project Groupware Webmail Edition 0
Not Vulnerable:	Horde Project IMP 4.3.4 Horde Project Groupware Webmail Edition 1.2.3 RC1

Horde IMP and Groupware Webmail Cached PGP Key Spoofing Vulnerability

Horde IMP and Groupware Webmail are prone to a PGP key spoofing vulnerability.

An attacker may leverage this issue to manipulate PGP key cache data in local address books, which may allow incorrectly signed inbound messages to be displayed as valid.

This issue affects the following Horde projects:

IMP prior to 4.3.4
Groupware Webmail Edition 1.1 through 1.2.2

Horde IMP and Groupware Webmail Cached PGP Key Spoofing Vulnerability

To exploit this issue, attackers require local interactive access to an affected computer.

Horde IMP and Groupware Webmail Cached PGP Key Spoofing Vulnerability

Solution:
The vendor has released updates. Please see the references for more information.

Horde IMP and Groupware Webmail Cached PGP Key Spoofing Vulnerability

References:

• CHANGES Revision 1.699.2.383 (Horde Project)
  
• Pandora Homepage (Pandora FMS Team)