Description
services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | horde3 | 3.1.3-4etch1 | DSA-1406-1 |
| Debian 3.1 | horde3 | 3.0.4-4sarge6 | DSA-1406-1 |
Advisories 1
- DSA-1406-1 horde3 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://lists.horde.org/archives/announce/2006/000287.html
- 18845 vdb-entry
- ADV-2006-2694 vdb-entry
- 21459 third-party-advisory
- SUSE-SR:2006:019 vendor-advisory
- 27565 third-party-advisory
- 1016442 vdb-entry
- http://lists.horde.org/archives/announce/2006/000288.html
- 1229 third-party-advisory
- http://moritz-naumann.com/adv/0011/hordemulti/0011.txt
- DSA-1406 vendor-advisory
- 20954 third-party-advisory
- 20060705 Public Advisory: Horde 3.1.1, 3.0.10 Multiple Security Issues mailing-list