CVE-2006-3549
CVSS5.0
发布时间 :2006-07-12 20:05:00
修订时间 :2011-03-07 21:38:53
NMCOP    

[原文]services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.


[CNNVD]Horde Application Framework Services多个跨站脚本攻击漏洞(CNNVD-200607-159)

        Horde Application Framework 3.0.0到3.0.10和3.1.0到3.1.1中的services/go.php未正确限制其图像代理能力,远程攻击者可以借助从服务器请求的url参数中的(1) http, (2) https,以及(3) ftp URL,进行"Web隧道"攻击并将服务器用作代理。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:horde:horde_application_framework:3.0.0
cpe:/a:horde:horde_application_framework:3.0.3Horde Application Framework 3.0.3
cpe:/a:horde:horde_application_framework:3.1.0
cpe:/a:horde:horde_application_framework:3.0.5Horde Application Framework 3.0.5
cpe:/a:horde:horde_application_framework:3.0.8Horde Application Framework 3.0.8
cpe:/a:horde:horde_application_framework:3.0.2Horde Application Framework 3.0.2
cpe:/a:horde:horde_application_framework:3.0.10Horde Application Framework 3.0.10
cpe:/a:horde:horde_application_framework:3.0.9Horde Application Framework 3.0.9
cpe:/a:horde:horde_application_framework:3.1.1Horde Application Framework 3.1.1
cpe:/a:horde:horde_application_framework:3.0.7Horde Application Framework 3.0.7
cpe:/a:horde:horde_application_framework:3.0.4Horde Application Framework 3.0.4
cpe:/a:horde:horde_application_framework:3.0.1Horde Application Framework 3.0.1
cpe:/a:horde:horde_application_framework:3.0.6Horde Application Framework 3.0.6

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3549
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3549
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200607-159
(官方数据源) CNNVD

- 其它链接及资源

http://lists.horde.org/archives/announce/2006/000287.html
(PATCH)  CONFIRM  http://lists.horde.org/archives/announce/2006/000287.html
http://www.vupen.com/english/advisories/2006/2694
(UNKNOWN)  VUPEN  ADV-2006-2694
http://www.securityfocus.com/bid/18845
(UNKNOWN)  BID  18845
http://www.securityfocus.com/archive/1/archive/1/439255/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues
http://securitytracker.com/id?1016442
(UNKNOWN)  SECTRACK  1016442
http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
(UNKNOWN)  MISC  http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
http://lists.horde.org/archives/announce/2006/000288.html
(UNKNOWN)  CONFIRM  http://lists.horde.org/archives/announce/2006/000288.html
http://www.novell.com/linux/security/advisories/2006_19_sr.html
(UNKNOWN)  SUSE  SUSE-SR:2006:019
http://www.debian.org/security/2007/dsa-1406
(UNKNOWN)  DEBIAN  DSA-1406
http://securityreason.com/securityalert/1229
(UNKNOWN)  SREASON  1229
http://secunia.com/advisories/27565
(UNKNOWN)  SECUNIA  27565
http://secunia.com/advisories/21459
(UNKNOWN)  SECUNIA  21459
http://secunia.com/advisories/20954
(UNKNOWN)  SECUNIA  20954

- 漏洞信息

Horde Application Framework Services多个跨站脚本攻击漏洞
中危 输入验证
2006-07-12 00:00:00 2006-07-18 00:00:00
远程  
        Horde Application Framework 3.0.0到3.0.10和3.1.0到3.1.1中的services/go.php未正确限制其图像代理能力,远程攻击者可以借助从服务器请求的url参数中的(1) http, (2) https,以及(3) ftp URL,进行"Web隧道"攻击并将服务器用作代理。

- 公告与补丁

        

- 漏洞信息 (F60840)

Debian Linux Security Advisory 1406-1 (PacketStormID:F60840)
2007-11-10 00:00:00
Debian  debian.org
advisory,remote,web,arbitrary,local,vulnerability,xss
linux,debian
CVE-2006-3548,CVE-2006-3549,CVE-2006-4256,CVE-2007-1473,CVE-2007-1474
[点击下载]

Debian Security Advisory 1406-1 - Several remote vulnerabilities have been discovered in the Horde web application framework. Moritz Naumann discovered that Horde allows remote attackers to inject arbitrary web script or HTML in the context of a logged in user (cross site scripting). Moritz Naumann discovered that Horde does not properly restrict its image proxy, allowing remote attackers to use the server as a proxy. Marc Ruef discovered that Horde allows remote attackers to include web pages from other sites, which could be useful for phishing attacks. iDefense discovered that the cleanup cron script in Horde allows local users to delete arbitrary files.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1406-1                    security@debian.org
http://www.debian.org/security/                            Thijs Kinkhorst
November 9th, 2007                      http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : horde3
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2006-3548 CVE-2006-3549 CVE-2006-4256 CVE-2007-1473 CVE-2007-1474
Debian Bug     : 378281 383416 434045

Several remote vulnerabilities have been discovered in the Horde web
application framework. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2006-3548

    Moritz Naumann discovered that Horde allows remote attackers
    to inject arbitrary web script or HTML in the context of a logged
    in user (cross site scripting).

    This vulnerability applies to oldstable (sarge) only.	    

CVE-2006-3549

    Moritz Naumann discovered that Horde does not properly restrict
    its image proxy, allowing remote attackers to use the server as a
    proxy.

    This vulnerability applies to oldstable (sarge) only.

CVE-2006-4256

    Marc Ruef discovered that Horde allows remote attackers to
    include web pages from other sites, which could be useful for
    phishing attacks.

    This vulnerability applies to oldstable (sarge) only.

CVE-2007-1473

    Moritz Naumann discovered that Horde allows remote attackers
    to inject arbitrary web script or HTML in the context of a logged
    in user (cross site scripting).

    This vulnerability applies to both stable (etch) and oldstable (sarge).

CVE-2007-1474

    iDefense discovered that the cleanup cron script in Horde
    allows local users to delete arbitrary files.

    This vulnerability applies to oldstable (sarge) only.


For the old stable distribution (sarge) these problems have been fixed in
version 3.0.4-4sarge6.

For the stable distribution (etch) these problems have been fixed in
version 3.1.3-4etch1.

For the unstable distribution (sid) these problems have been fixed in
version 3.1.4-1.

We recommend that you upgrade your horde3 package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6.dsc
      Size/MD5 checksum:      920 a829a3791ed40777b0a4995be6727f13
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6.diff.gz
      Size/MD5 checksum:    13978 ab0dc18c4744b21919c154ac81600ad7
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4.orig.tar.gz
      Size/MD5 checksum:  3378143 e2221d409ba1c8841ce4ecee981d7b61

  Architecture independent components:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.0.4-4sarge6_all.deb
      Size/MD5 checksum:  3437942 f2cd9a0c7cb7e800d357d206d9f19841


Debian GNU/Linux 4.0 alias etch
- -------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1.dsc
      Size/MD5 checksum:      974 9fe3ec9d81a0d0c8ec6dd2ae3e14ed40
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1.diff.gz
      Size/MD5 checksum:    10633 84cad3aed2026c8a6358891897a15ee7
    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3.orig.tar.gz
      Size/MD5 checksum:  5232958 fbc56c608ac81474b846b1b4b7bb5ee7

  Architecture independent components:

    http://security.debian.org/pool/updates/main/h/horde3/horde3_3.1.3-4etch1_all.deb
      Size/MD5 checksum:  5270226 34a3af59a3469722ecf832948d390cea

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHNOM0Xm3vHE4uyloRAhqCAKDW38OVpHkAYAfr9LNzvh5k/j+8fQCg29kw
KknLxPttFWUKWRsaCB5PesA=
=SoAf
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
    

- 漏洞信息

27032
Horde go.php url Parameter XSS
Remote / Network Access Input Manipulation
Loss of Integrity

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-07-05 Unknow
2006-07-05 Unknow

- 解决方案

Upgrade to version 3.0.11, 3.1.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete
 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站