Emanuele Gentili | emgent blog

Affected by security bug quite significant, horde3 is still be vulnerable to Ubuntu repositories.

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain
configurations, allows remote authenticated users to read and execute arbitrary files via “..” sequences and a null byte in the theme name.
Fix directory traversal vulnerability in Registry.php which allows an attacker to read and execute arbitrary local files via crafted
path sequences.

Vulnerable Version:

• Hardy (upgraded)
• Gutsy
• Feisty
• Edgy
• Dapper

CVE

• 2008-1284

Debdiffs:

• gutsy_horde3_3.1.4-1ubuntu0.1.debdiff
• feisty_horde3_3.1.3-4ubuntu0.1.debdiff
• edgy_horde3_3.1.3-1ubuntu0.1.debdiff
• dapper_horde3_3.1.1-1ubuntu0.1.debdiff

Upgrade by .deb packages:

• horde3_3.1.4-1ubuntu0.1~emgentsecurity0_all.deb (Gutsy)
• horde3_3.1.3-4ubuntu0.1~emgentsecurity0_all.deb (Feisty)
• horde3_3.1.3-1ubuntu0.1~emgentsecurity0_all.deb (Edgy)
• horde3_3.1.1-1ubuntu0.1~emgentsecurity0_all.deb (Dapper)

Upgrade by Repository:

• Gutsy

deb http://ppa.launchpad.net/emgent/ubuntu gutsy main
deb-src http://ppa.launchpad.net/emgent/ubuntu gutsy main

 apt-get update

apt-get upgrade

•  Feisty

deb http://ppa.launchpad.net/emgent/ubuntu feisty main
deb-src http://ppa.launchpad.net/emgent/ubuntu feisty main

 apt-get update

 apt-get upgrade

• Edgy

deb http://ppa.launchpad.net/emgent/ubuntu edgy main
deb-src http://ppa.launchpad.net/emgent/ubuntu edgy main

 apt-get update

 apt-get upgrade

• Dapper

deb http://ppa.launchpad.net/emgent/ubuntu dapper main
deb-src http://ppa.launchpad.net/emgent/ubuntu dapper main

 apt-get update

 apt-get upgrade