Description
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | roundcube | 0.7.2-9 | — |
| Debian 13 | roundcube | 0.7.2-9 | — |
| Debian 12 | roundcube | 0.7.2-9 | — |
References
- http://habrahabr.ru/post/174423/
- http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/
- [dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0) mailing-list
- openSUSE-SU-2013:0671 vendor-advisory
- [oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options mailing-list