Before I get into the technical details of this report, and the Horde =20
Team's response, I want to take a minute to explain the perceived slow =20
response by the Horde Team to this report. This issue was released to =20
Bugtraq before any notification was sent to the Horde team. The =20
notification sent to security@horde.org was received Thursday at =20
nearly 10:30PM Eastern Time , a time after which most of our =20
developers are no longer are active. It was also sent 4 minutes after =20
the Bugtraq email. There was no bug filed on our website, no prior =20
warning email, and no courtesy shown by HostGator to the Horde =20
community. The Horde Team does have established procedures for =20
handling and coordinating security vulnerability reports and we are =20
disappointed that HostGator was so hasty to report the vulnerability =20
publicly before a proper fix could be prepared. Those interested in =20
learning more about Horde's security policy and the best way to report =20
vulnerabilities to us should visit =20
http://wiki.horde.org/SecurityManagement.

Quoting ppelanne@hostgator.com:

> Horde 3.1.6 arbitrary file inclusion vulnerability, proof of concept & pat=
ch.
>
> A severe security vulnerability affects any unix distribution =20
> running version 3.1.6 of the Horde webmail client included in most =20
> popular webhosting control panels. All previous versions are also =20
> affected and it is believed although not yet proven that Horde =20
> Groupware is also vulnerable.
>
The Horde team has investigated this report and found it to be =20
reproducible, though not exactly as reported. The SQL example in the =20
original post does prevent the themes from appearing but does not =20
execute the file in question. It is unclear based on their limited =20
information whether they are using a modified version of Horde or if =20
there were other factors that lead to the behavior reported. However =20
if a null byte can be inserted into the theme name (for instance when =20
using the LDAP preference backend which stores preference values in =20
Base64 encoding) it does become possible to cause a file to be =20
included and executed.

Based on our research it is true that Horde 3.1.6 does suffer a local =20
file inclusion vulnerability which in certain configurations can also =20
include an authenticated user-supplied file. We have prepared a patch =20
and a new release of Horde 3.1.7 to address this bug. In the short =20
term admins are encouraged to apply the patch at the URL below which =20
mitigates the vulnerability:

http://cvs.horde.org/diff.php?r1=3D1...rk/Horde/Hord=
e/Registry.php

If there are any questions about our research, findings, or to report =20
further problems with this patch, please see our security protocol =20
page at http://wiki.horde.org/SecurityManagement or contact =20
security@horde.org.

/BAK/
--
Ben Klang
Horde Project
bklang@horde.org
http://www.horde.org

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.