Technical Description

A vulnerability has been identified in Horde Groupware and Turba, which could be exploited by attackers to bypass security restrictions and disclose sensitive information. This issue is caused by missing access checks, which could be exploited to gain unauthorized access to contacts in the same SQL table, if the unique key of another user's contact can be guessed.

Affected Products

Horde Groupware versions prior to 1.0.4
Horde Groupware Webmail Edition versions prior to 1.0.5
Turba Contact Manager versions prior to 2.1.7

Solution

Upgrade to Horde Groupware version 1.0.4, Horde Groupware Webmail version 1.0.5 and Turba Contact Manager version 2.1.7 :
http://www.horde.org/download/

References

http://www.vupen.com/english/advisories/2008/0593
http://marc.info/?l=horde-announce&m=120309314205422&w=2
http://marc.info/?l=horde-announce&m=120309756012698&w=2
http://marc.info/?l=horde-announce&m=120309860914364&w=2

Credits

Vulnerability reported by the vendor.

ChangeLog

2008-02-19 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.