Vulnerability Bulletins |
Aumento de privilegios en Horde |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software |
Horde Application Framework 3.2.x < 3.2.5 Horde Application Framework 3.3.x < 3.3.5 Groupware 1.1.x < 1.1.6 Groupware 1.2.x < 1.2.4 Groupware Webmail Edition 1.1.x < 1.1.6 Groupware Webmail Edition 1.2.x < 1.2.4 |
Description |
|
|
Se ha descubierto una vulnerabilidad en Horde Application Framework. La vulnerabilidad reside en un error en el manejo de los campos de una imagen en los formularios. Un atacante remoto podría sobreescribir ficheros arbitrarios mediante los campos de un formulario imagen. |
|
Solution |
|
|
Actualización de software Debian (DSA-1897-1) Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch6.diff.gz http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch6.dsc http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3.orig.tar.gz Architecture independent packages: http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch6_all.deb Debian (DSA-1897-1) Debian Linux 5.0 Source http://security.debian.org/pool/updates/main/h/horde3/horde3_3.2.2+debian0-2+lenny1.dsc http://security.debian.org/pool/updates/main/h/horde3/horde3_3.2.2+debian0.orig.tar.gz http://security.debian.org/pool/updates/main/h/horde3/horde3_3.2.2+debian0-2+lenny1.diff.gz Architecture independent packages: http://security.debian.org/pool/updates/main/h/horde3/horde3_3.2.2+debian0-2+lenny1_all.deb |
|
Standar resources |
|
| Property | Value |
| CVE | CVE-2009-3236 |
| BID | 36382 |
Other resources |
|
|
Debian Security Advisory (DSA-1897-1) http://lists.debian.org/debian-security-announce/2009/msg00218.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2009-09-29 |
| 1.1 | Aviso emitido por Suse (SUSE-SA:2010:004) | 2010-03-01 |