[arch-security] [ASA-201711-27] roundcubemail: arbitrary filesystem access

[Morten Linderud]

Arch Linux Security Advisory ASA-201711-27
==========================================

Severity: High
Date    : 2017-11-21
CVE-ID  : CVE-2017-16651
Package : roundcubemail
Type    : arbitrary filesystem access
Remote  : Yes
Link    : https://security.archlinux.org/AVG-506

Summary
=======

The package roundcubemail before version 1.3.3-1 is vulnerable to
arbitrary filesystem access.

Resolution
==========

Upgrade to 1.3.3-1.

# pacman -Syu "roundcubemail>=1.3.3-1"

The problem has been fixed upstream in version 1.3.3.

Workaround
==========

None.

Description
===========

Roundcube Webmail 1.3.x before 1.3.3 allows unauthorized access to
arbitrary files on the host's filesystem, including configuration
files, as exploited in the wild in November 2017. The attacker must be
able to authenticate at the target system with a valid
username/password as the attack requires an active session. The issue
is related to file-based attachment plugins and
_task=settings&_action=upload-display&_from=timezone requests.

Impact
======

A remote authenticated non-admin user is able to read arbitrary files
on the affected host.

References
==========

https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c21d6c95baab6d806
https://github.com/roundcube/roundcubemail/issues/6026
https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
https://security.archlinux.org/CVE-2017-16651
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171121/49399a32/attachment.asc>