oss-security - CVE Request -- Round Cube Webmail -- DoS (unavailability to access user's INBOX) after receiving an email message with the URL in the Subject

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4EA807BE.5000209@redhat.com>
Date: Wed, 26 Oct 2011 15:14:38 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com
Subject: CVE Request -- Round Cube Webmail -- DoS (unavailability to access
 user's INBOX) after receiving an email message with the URL in the Subject

Hello Josh, Steve, vendors,

   a security flaw was found in the way Round Cube Webmail,
a browser-based multilingual IMAP client, processed certail
email-messages containing URL link in the message Subject,
when the Suhosin check for dangerous PHP files inclusion
was enabled. A remote attacker could send a specially-crafted
email message to the victim, leading to denial of service
(situation, where victim could not open their mail INBOX
folder with the crafted email message present).

References:
[1] http://trac.roundcube.net/ticket/1488086
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=646675
[3] https://bugs.php.net/bug.php?id=55475

Note: This is a strange one. The original source of the issue
       seems to be PHP-Pear is_a() routine autoload bug:
       https://bugs.php.net/bug.php?id=55475

       and truly this deficiency might affect another package,
       than roundcubemail (php-pear-MDB2 in Fedora case).

       But it is a combination of this php-pear-MDB2 deficiency,
       roundcube's handling of is_a() routine and Suhosin's
       check for dangerous *.php files inclusion, which in
       result might lead into situation, where valid roundcubemail
       user couldn't access their INBOX just for some email
       message being present in it.

       In short, not sure if the CVE id should be assigned to
       the PHP PEAR bug or to the roundcubemail package.

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.