Horde IMP Database Files SQL Injection Vulnerabilities
BID:6559
Info
Horde IMP Database Files SQL Injection Vulnerabilities
| Bugtraq ID: | 6559 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0025 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 08 2003 12:00AM |
| Updated: | Jul 11 2009 07:17PM |
| Credit: | Discovery of this issue is credited to Jouko Pynnonen <[email protected]>. |
| Vulnerable: |
Horde Project IMP 2.2.8 Horde Project IMP 2.2.7 Horde Project IMP 2.2.6 Horde Project IMP 2.2.5 Horde Project IMP 2.2.4 Horde Project IMP 2.2.3 Horde Project IMP 2.2.2 Horde Project IMP 2.2.1 Horde Project IMP 2.2 Horde Project Horde 1.2.8 Horde Project Horde 1.2.7 Horde Project Horde 1.2.6 Horde Project Horde 1.2.5 Horde Project Horde 1.2.4 Horde Project Horde 1.2.3 Horde Project Horde 1.2.2 Horde Project Horde 1.2.1 Horde Project Horde 1.2 |
| Not Vulnerable: |
Horde Project IMP 3.1 Horde Project IMP 3.0 |
Solution / Fix
Horde IMP Database Files SQL Injection Vulnerabilities
Solution:
Debian released an advisory (DSA 229-1) containing incorrect fixes. Debian followed up with a revision (DSA 229-2) which contains the correct fixes.
This issue reportedly does not exist in Horde IMP versions 3.0 and later. Horde IMP 2.2 is no longer being actively developed. Users are advised to upgrade.
Conectiva has released advisory CLA-2003:690 with fixes to address this issue.
Horde Project IMP 2.2
Horde Project IMP 2.2.1
Horde Project IMP 2.2.2
Horde Project IMP 2.2.3
Horde Project IMP 2.2.4
Horde Project IMP 2.2.5
Horde Project IMP 2.2.6
Horde Project IMP 2.2.7
Horde Project IMP 2.2.8
Solution:
Debian released an advisory (DSA 229-1) containing incorrect fixes. Debian followed up with a revision (DSA 229-2) which contains the correct fixes.
This issue reportedly does not exist in Horde IMP versions 3.0 and later. Horde IMP 2.2 is no longer being actively developed. Users are advised to upgrade.
Conectiva has released advisory CLA-2003:690 with fixes to address this issue.
Horde Project IMP 2.2
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.1
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.2
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.3
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.4
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.5
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.6
-
Debian imp_2.2.6-0.potato.5.2_all.deb
Debian GNU/Linux 2.2 alias potato.
http://security.debian.org/pool/updates/main/i/imp/imp_2.2.6-0.potato. 5.2_all.deb -
Debian imp_2.2.6-5.2_all.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/i/imp/imp_2.2.6-5.2_all.d eb -
Horde IMP 3.1
http://www.horde.org/imp/3.1/ -
S.u.S.E. imp-2.2.6-189.ppc.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zima1/imp-2.2.6-189.ppc.rpm -
S.u.S.E. imp-2.2.6-189.src.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/imp-2.2.6-189.src.rpm -
S.u.S.E. imp-2.2.6-246.i386.rpm
S.u.S.E. 8.0
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zima1/imp-2.2.6-246.i386.r pm -
S.u.S.E. imp-2.2.6-246.src.rpm
S.u.S.E. 8.0
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/imp-2.2.6-246.src.rpm -
S.u.S.E. imp-2.2.6-247.i386.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/i386/update/7.3/zima1/imp-2.2.6-247.i386.r pm -
S.u.S.E. imp-2.2.6-247.src.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/imp-2.2.6-247.src.rpm -
S.u.S.E. imp-2.2.6-248.i586.rpm
S.u.S.E. 8.1
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/imp-2.2.6-248.i58 6.rpm -
S.u.S.E. imp-2.2.6-248.src.rpm
S.u.S.E. 8.1
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/imp-2.2.6-248.src. rpm -
S.u.S.E. imp-2.2.6-85.sparc.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zima1/imp-2.2.6-85.sparc. rpm -
S.u.S.E. imp-2.2.6-85.src.rpm
S.u.S.E. 7.3
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/imp-2.2.6-85.src.rpm
Horde Project IMP 2.2.7
-
Horde IMP 3.1
http://www.horde.org/imp/3.1/
Horde Project IMP 2.2.8
-
Conectiva horde-1.2.8-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-1.2.8-1U70_2cl.noar ch.rpm -
Conectiva horde-1.2.8-2U80_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/horde-1.2.8-2U80_1cl.noarch .rpm -
Conectiva horde-mysql-1.2.8-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-mysql-1.2.8-1U70_2c l.noarch.rpm -
Conectiva horde-mysql-1.2.8-2U80_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/horde-mysql-1.2.8-2U80_1cl. noarch.rpm -
Conectiva horde-pgsql-1.2.8-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-pgsql-1.2.8-1U70_2c l.noarch.rpm -
Conectiva horde-pgsql-1.2.8-2U80_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/horde-pgsql-1.2.8-2U80_1cl. noarch.rpm -
Conectiva horde-shm-1.2.8-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-shm-1.2.8-1U70_2cl. noarch.rpm -
Conectiva horde-shm-1.2.8-2U80_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/horde-shm-1.2.8-2U80_1cl.no arch.rpm -
Horde IMP 3.1
http://www.horde.org/imp/3.1/