Horde Authentication Framework Composite Driver Authentication Bypass Vulnerability

Bugtraq ID:	48191
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2011 12:00AM
Updated:	Jun 09 2011 12:00AM
Credit:	Michael Groene
Vulnerable:	Horde Project Horde 1.0.3 Horde Project Horde 1.0.0alpha1
Not Vulnerable:	Horde Project Horde 1.0.4

Horde Authentication Framework Composite Driver Authentication Bypass Vulnerability

Horde Authentication Framework is prone to an authentication-bypass vulnerability because it fails to properly validate login requests.

Attackers can exploit this issue to gain unauthorized access to the affected application.

Horde 1.0.0alpha1 through 1.0.3 are vulnerable; other versions may also be affected.

Horde Authentication Framework Composite Driver Authentication Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Horde Authentication Framework Composite Driver Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Horde Authentication Framework Composite Driver Authentication Bypass Vulnerability

References:

• [#10211] Login successes despite wrong username with composite authentication (Horde)
  
• [announce] SECURITY: Horde_Auth 1.0.4 (Horde)
  
• Horde Homepage (Horde Project)