Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT Security Bulletin ASB-2013.0121 A number of vulnerabilities have been identified in Nag, Horde Application Framework, Internet Mail Program, Turba Contact Manager, Kronolith Calendar Application, Mnemo Note Manager, Horde Groupware and the Horde Groupware Webmail Edition 31 October 2013 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Nag H5 4.1.3 Horde 5.1.5 IMP H5 6.1.5 Turba H5 4.1.3 Kronolith H5 4.1.4 Mnemo H5 4.1.2 Horde Groupware 5.1.3 Horde Groupware Webmail Edition 5.1.3 Operating System: UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Cross-site Scripting -- Remote with User Interaction Cross-site Request Forgery -- Remote with User Interaction Resolution: Patch/Upgrade Member content until: Saturday, November 30 2013 OVERVIEW New versions of the Nag Task List Manager, Horde Application Framework, Internet Mail Program (IMP), Turba Contact Manager, Kronolith Calendar Application, Mnemo Note Manager, Horde Groupware and the Horde Groupware Webmail Edition have been released fixing a number of vulnerabilities. IMPACT The following announcement was made regarding these releases: "Fixed XSS and CSRF vulnerabilities." [1 - 8] MITIGATION The vendor recommends to upgrading to Nag 4.1.3 [1], Horde 5.1.5 [2], IMP 6.1.5 [3], Turba 4.1.3 [4], Kronolith 4.1.4 [5], Mnemo 4.1.2 [6], Horde Groupware 5.1.3 [7], Horde Groupware Webmail Edition 5.1.3 [8] to resolve these issues. REFERENCES [1] [announce] Nag H5 (4.1.3) (final) http://lists.horde.org/archives/announce/2013/000962.html [2] [announce] Horde 5.1.5 (final) http://lists.horde.org/archives/announce/2013/000957.html [3] [announce] IMP H5 (6.1.5) (final) http://lists.horde.org/archives/announce/2013/000958.html [4] [announce] Turba H5 (4.1.3) (final) http://lists.horde.org/archives/announce/2013/000960.html [5] [announce] Kronolith H5 (4.1.4) (final) http://lists.horde.org/archives/announce/2013/000961.html [6] [announce] Mnemo H5 (4.1.2) (final) http://lists.horde.org/archives/announce/2013/000963.html [7] [announce] Horde Groupware 5.1.3 (final) http://lists.horde.org/archives/announce/2013/000966.html [8] [announce] Horde Groupware Webmail Edition 5.1.3 (final) http://lists.horde.org/archives/announce/2013/000967.html AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBUnHnHRLndAQH1ShLAQIoWg//WeEXEjIfMX/9plQhlBZQgFZxyuappsKQ K00PGm0VPxyGLcuRVXlL2FwJnzVS0W3GMq6R7QLIq58gisNQmh5xFA9H2SZ7zLl5 0zRcUJ17NLgwHM+zUvcXcxMwNRhXqnKGwakI1GVq6CfJNIHhPwoKgbV0omPqGu+i KiMutk+QENp8LxDsusmPRp1qwBfDw9FIj+xd9yVt0yKTjWU5VnFWMT7ilX7Di/qJ tngK3D0DxDzW5wEBXUxrebiZCHwFU3UTaOdOjjYgCVhXkyT17V4eMSjpcpOeDPhP TdbViK6sBYX+KqBrt184yLGmzf7fefRtahTwABTdaTtXFZa7T+TDE6Lf4s9/XbSF jOtKWC67Lj9pu7KNyupxWnnaSedswdLKVKI7frimlEN3NRlahjT7W9AnbLnJn5io z37W0nXKG7w6hGkORYQroNNEYd9GKW5oIdM8NYTh44chmrRPMoPiADES82AnAgKl o8k8sVZJ19zs/SQYdVWY8r4XtQ2mo6AMc45BKL0euQr/3hRhYskiIYzbwB9pQ2YB elcOQ5Yo/XOL4aPkwmuKjjr2+bLicFUJTn+xbQGn7g4KiUX/7DrPiuZxFa2UN7wN YrM/B/zBUSxDC7Lv3ML7t7Mjq+mjyzgJredkFTEuQmsfOYKOSMY5heKG+HfQDupB 3dg24Frhm+o= =7cwu -----END PGP SIGNATURE-----