Summary
The remote host is missing an update to horde3
announced via advisory DSA 1966-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201966-1
Insight
Several vulnerabilities have been found in horde3, the horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems:
CVE-2009-3237
It has been discovered that horde3 is prone to cross-site scripting attacks via crafted number preferences or inline MIME text parts when using text/plain as MIME type.
For lenny this issue was already fixed, but as an additional security precaution, the display of inline text was disabled in the configuration file.
CVE-2009-3701
It has been discovered that the horde3 administration interface is prone to cross-site scripting attacks due to the use of the PHP_SELF variable.
This issue can only be exploited by authenticated administrators.
CVE-2009-4363
It has been discovered that horde3 is prone to several cross-site scripting attacks via crafted data:text/html values in HTML messages.
For the stable distribution (lenny), these problems have been fixed in version 3.2.2+debian0-2+lenny2.
For the oldstable distribution (etch), these problems have been fixed in version 3.1.3-4etch7.
For the testing distribution (squeeze) and the unstable distribution (sid), these problems have been fixed in version 3.3.6+debian0-1.
We recommend that you upgrade your horde3 packages.
Severity
Classification
-
CVE CVE-2009-3237, CVE-2009-3701, CVE-2009-4363 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities