|
|
Horde IMP存在本地 'prefs.lang'漏洞
发布时间：2001-07-26
更新时间：2001-07-26
严重程度：中
威胁程度：本地拒绝服务
错误类型：设计错误
利用方式：服务器模式
受影响系统Horde Imp 2.2.4
Horde Imp 2.2.3
Horde IMP 2.2.2
Horde IMP 2.2.1
+ Horde Horde 1.2.1
Horde IMP 2.2
+ Horde Horde 1.2
Horde IMP 2.0
- PHP PHP 4.0.1pl2
- PHP PHP 4.0.1
- PHP PHP 4.00
- PHP PHP 3.0.16 详细描述
Imp是一个基于WEB的MAIL接口/客户端，其中Hord Application Framework
提供支持处理如压缩，浏览器探测，连接跟踪更功能。
攻击者可以在WEB服务程序的文件系统上建立一名称为'prefs.lang'文件，
并且保证其全局可读，可以导致攻击者获得WEB服务的进程权利。因为此
文件的内容，可以被PHP解释并执行。
测试代码
见描述部分。
解决方案
更新程序下载：
Horde Imp 2.2.4:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
Horde Imp 2.2.3:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
Horde IMP 2.2.2:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
Horde IMP 2.2.1:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
Horde IMP 2.2:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
Horde IMP 2.0:
Conectiva upgrade 4.1 imp-2.2.6-1U41_2cl.noarch.rpm
http://www.securityfocus.com/external/ftp://atualizacoes.conectiva.com.br/4.1/noarch/imp-2.2.6-1U41_2cl.noarch.rpm
Conectiva upgrade 4.2 imp-2.2.6-1U42_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/4.2/noarch/imp-2.2.6-1U42_2cl.noarch.rpm
Conectiva upgrade 5.0 imp-2.2.6-1U50_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.6-1U50_2cl.noarch.rpm
Conectiva upgrade 5.1 imp-2.2.6-1U51_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.6-1U51_2cl.noarch.rpm
Conectiva upgrade 6.0 imp-2.2.6-1U60_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.6-1U60_2cl.noarch.rpm
Conectiva upgrade 7.0 imp-2.2.6-1U70_2cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.6-1U70_2cl.noarch.rpm
相关信息
|
