Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	36920
Class:	Design Error
CVE:	CVE-2009-4076 CVE-2009-4077
Remote:	Yes
Local:	No
Published:	Nov 04 2009 12:00AM
Updated:	Apr 13 2015 09:46PM
Credit:	Shuya Ueki, Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc.
Vulnerable:	Roundcube Round Cube Webmail 0.2.2 Roundcube Round Cube Webmail 0.1 -20051021 Roundcube Round Cube Webmail 0.2-Stable Roundcube Round Cube Webmail 0.2-3 Beta Roundcube Round Cube Webmail 0.2-1 Alpha Roundcube Round Cube Webmail 0.1Rc2 Roundcube Round Cube Webmail 0.1-Beta2 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5
Not Vulnerable:	Roundcube Round Cube Webmail 0.3.1 Roundcube Round Cube Webmail 0.3 Stable

Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities

Roundcube Webmail is prone to multiple cross-site request-forgery vulnerabilities.

An attacker can exploit these issues to alter user information or send arbitrary emails. Other attacks may also be possible.

Versions prior to Roundcube Webmail 0.3-stable are vulnerable.

Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues, an attacker must entice a user into visiting a malicious site.

Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5

• Mandriva roundcubemail-0.2.2-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva roundcubemail-0.2.2-0.1mdvmes5.noarch.rpm
  http://www.mandriva.com/en/download/

Roundcube Webmail Multiple Cross Site Request Forgery Vulnerabilities

References:

• RoundCube Webmail Changelog (RoundCube)
  
• RoundCube Webmail Homepage (RoundCube)
  
• JVN#72974205 Roundcube Webmail vulnerable to cross-site request forgery (JVN)
  
• JVN#75694913 Roundcube Webmail vulnerable to cross-site request forgery (JVN)