Horde IMP Remote Information Disclosure Vulnerability

Bugtraq ID:	40294
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 20 2010 12:00AM
Updated:	May 21 2010 03:52PM
Credit:	TEHTRI-Security
Vulnerable:	Horde Project IMP 4.3.4 Horde Project IMP 4.3.3 Horde Project IMP 4.3.2 Horde Project IMP 4.2.2 Horde Project IMP 4.2.1 Horde Project IMP 4.1.5 Horde Project IMP 4.1.4 Horde Project IMP 4.0.4 Horde Project IMP 4.0.3 Horde Project IMP 4.0.2 Horde Project IMP 4.0.1 Horde Project IMP 4.0 Horde Project IMP 3.2.6 Horde Project IMP 3.2.5 Horde Project IMP 3.2.4 Horde Project IMP 3.2.3 Horde Project IMP 3.2.2 Horde Project IMP 3.2.1 Horde Project IMP 3.2 Horde Project IMP 3.1.2 Horde Project IMP 3.1 Horde Project IMP 3.0 Horde Project IMP 2.3.6 Horde Project IMP 2.3 Horde Project IMP 2.2.8 + Horde Project Horde 1.2.8 Horde Project IMP 2.2.7 - Caldera OpenLinux Server 3.1.1 - Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.7 Horde Project IMP 2.2.6 - Debian Linux 2.2 + Horde Project Horde 1.2.6 Horde Project IMP 2.2.5 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.5 Horde Project IMP 2.2.4 + Caldera OpenLinux Server 3.1 + Horde Project Horde 1.2.4 Horde Project IMP 2.2.3 + Horde Project Horde 1.2.3 Horde Project IMP 2.2.2 + Horde Project Horde 1.2.2 Horde Project IMP 2.2.1 + Horde Project Horde 1.2.1 Horde Project IMP 2.2 + Horde Project Horde 1.2 Horde Project IMP 2.0.9 Horde Project IMP 2.0.8 Horde Project IMP 2.0 - PHP PHP 4.0.1 pl2 - PHP PHP 4.0.1 - PHP PHP 4.0 0 - PHP PHP 3.0.16
Not Vulnerable:

Horde IMP Remote Information Disclosure Vulnerability

Horde IMP is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks.

This issue affects unknown versions of Horde IMP. This BID will be updated when more details become available.

Horde IMP Remote Information Disclosure Vulnerability

An attacker can exploit this issue using readily available tools.

Horde IMP Remote Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Horde IMP Remote Information Disclosure Vulnerability

References:

• IMP Homepage (Horde Project)
  
• Re: [core] CVE Request for Horde and Squirrelmail (Marcus I. Ryan)
  
• Re: CVE Request for Horde and Squirrelmail (Thijs Kinkhorst)
  
• Security-Advisory: TEHTRI-SA-2010-010 - Horde 0-day (TEHTRI-Security)