リモートホストにインストールされているHorde、Horde Groupware、またはHorde Groupware Webmail Editionのバージョンは、「lib/Horde/Image.php」でPHPコードをインクルードするために使用される前に、「Horde_Image: ：factory」メソッドの「driver」引数に対する入力のフィルタリングに失敗します。PHP の「register_globals」設定と「magic_quotes_gpc」設定に関係なく、認証されていない攻撃者が、この問題を悪用して、WebサーバーユーザーIDの権限に従って、リモートホストで任意のファイルを表示したり、任意のPHPコードを実行したりする可能性があります。 

このインストールは、「services/portal/cloud_search.php」スクリプト内のクロスサイトスクリプティングの問題の影響も受ける可能性があることが報告されていますが、Nessusではそれを確認していないことに注意してください。

3.3.6 へのアップグレード - 多数のセキュリティバグを修正します

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

遠端主機上安裝的 Horde、Horde Groupware 或 Horde Groupware Webmail Edition 無法篩選 'Horde_Image: : actory' 方法，便會將其用於在 'lib/Horde/Image.php' 中引入 PHP 程式碼。無論 PHP 的「register_globals」和「magic_quotes_gpc」設定為何，未經驗證的攻擊者皆可惡意利用此問題，以執行 Web 伺服器使用者 id 的權限，在遠端主機上檢視任意檔案或可能執行任意 PHP 程式碼。 

請注意，此安裝也可能受到 'services/portal/cloud_search.php' 指令碼中一個跨網站指令碼問題影響，不過 Nessus 並未針對該問題進行檢查。

Upgrade to 3.3.6 - Fixes a lot of security bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition installed on the remote host fails to filter input to the 'driver' argument of the 'Horde_Image::factory' method before using it to include PHP code in 'lib/Horde/Image.php'.  Regardless of PHP's 'register_globals' and 'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this issue to view arbitrary files or possibly to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id. 

Note that this install is also likely affected by a cross-site scripting issue in the 'services/portal/cloud_search.php' script although Nessus has not checked for that.

Version update to horde 3.1.9 fixes a cross-site-scripting (XSS) issue (CVE-2008-5917) and an include file problem (CVE-2009-0932).

Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-0932     Gunnar Wrobel discovered a directory traversal     vulnerability, which allows attackers to include and     execute arbitrary local files via the driver parameter     in Horde_Image.

  - CVE-2008-3330     It was discovered that an attacker could perform a     cross-site scripting attack via the contact name, which     allows attackers to inject arbitrary html code. This     requires that the attacker has access to create     contacts.

  - CVE-2008-5917     It was discovered that the horde XSS filter is prone to     a cross-site scripting attack, which allows attackers to     inject arbitrary html code. This is only exploitable     when Internet Explorer is used.

The remote host is affected by the vulnerability described in GLSA-200909-14 (Horde: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Horde:
    Gunnar Wrobel reported an input sanitation and directory traversal     flaw in framework/Image/Image.php, related to the 'Horde_Image driver     name' (CVE-2009-0932).
    Gunnar Wrobel reported that data sent     to horde/services/portal/cloud_search.php is not properly sanitized     before used in the output (CVE-2009-0931).
    It was reported     that data sent to framework/Text_Filter/Filter/xss.php is not properly     sanitized before used in the output (CVE-2008-5917).
    Horde Passwd: David Wharton reported that data sent via the 'backend'     parameter to passwd/main.php is not properly sanitized before used in     the output (CVE-2009-2360).
    Horde IMP: Gunnar Wrobel reported that data sent to smime.php, pgp.php,     and message.php is not properly sanitized before used in the output     (CVE-2009-0930).
  Impact :

    A remote authenticated attacker could exploit these vulnerabilities to     execute arbitrary PHP files on the server, or disclose the content of     arbitrary files, both only if the file is readable to the web server. A     remote authenticated attacker could conduct Cross-Site Scripting     attacks. NOTE: Some Cross-Site Scripting vectors are limited to the     usage of Microsoft Internet Explorer.
  Workaround :

    There is no known workaround at this time.

The version of Horde, Horde Groupware, or Horde Groupware Webmail Edition installed on the remote host fails to filter input to the 'driver' argument of the 'Horde_Image: : factory' method before using it to include PHP code in 'lib/Horde/Image.php'.  Regardless of PHP's 'register_globals' and 'magic_quotes_gpc' settings, an unauthenticated attacker can exploit this issue to view arbitrary files or possibly to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user ID.

 Note that this install is also likely affected by a cross-site scripting issue in the 'services/portal/cloud_search.php' script.

ID	名稱	產品	系列	已發布	已更新	嚴重性
35554	Horde Horde_Image：：ファクトリドライバー引数ローカルファイルインクルード	Nessus	CGI abuses	2009/1/29	2022/4/11	high
47404	Fedora 13：horde-3.3.6-1.fc13（2010-5563）	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
35554	Horde Horde_Image: : 原廠驅動程式引數本機檔案引入	Nessus	CGI abuses	2009/1/29	2022/4/11	high
47390	Fedora 11 : horde-3.3.6-1.fc11 (2010-5483)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
47395	Fedora 12 : horde-3.3.6-1.fc12 (2010-5520)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
47390	Fedora 11：horde-3.3.6-1.fc11（2010-5483）	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
47395	Fedora 12：horde-3.3.6-1.fc12（2010-5520）	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
35554	Horde Horde_Image::factory driver Argument Local File Inclusion	Nessus	CGI abuses	2009/1/29	2022/4/11	high
36005	openSUSE 10 Security Update : horde (horde-6099)	Nessus	SuSE Local Security Checks	2009/3/24	2021/1/14	medium
36119	Debian DSA-1765-1 : horde3 - Multiple vulnerabilities	Nessus	Debian Local Security Checks	2009/4/9	2021/1/4	medium
39985	openSUSE Security Update : horde (horde-657)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
40961	GLSA-200909-14 : Horde: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/9/14	2021/1/6	medium
47404	Fedora 13 : horde-3.3.6-1.fc13 (2010-5563)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
4835	Horde < 3.3.3 / 3.2.4 Horde_Image::factory driver Argument Local File Inclusion	Nessus Network Monitor	CGI	2009/1/29	2019/3/6	high

偵測

搜尋 Plugin

high

medium

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

high