oss-security - CVE request: code execution in Horde

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3362705.8pMVodbJo5@storm.m.i2n>
Date: Thu, 21 Sep 2017 16:50:07 +0200
From: Thomas Jarosch <thomas.jarosch@...ra2net.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: code execution in Horde_Image 2.0.0 to 2.5.1

Hello oss security,

Intra2net AG found a code execution vulnerability in the "Horde_Image" library 
of the Horde framework (https://www.horde.org/). The "_raw()" function of the 
ImageMagick "im" backend passes the "$index" parameter unsanitized to the 
shell. This parameter is f.e. exposed by the getImageAtIndex($index) function.

No core horde application exposes the $index parameter directly
to the net, so a "remote" code execution might be given for third party 
applications only. Read: The risk is low for normal horde users.

Affected versions are 2.0.0 to 2.5.1.
A fixed version 2.5.2 has been released.

Upstream fix:
https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b

Official release announcement:
https://marc.info/?l=horde-announce&m=150600299528079&w=2
-----------------------------------
Hello,

a Remote Code Execution vulnerability has been found in the  
Horde_Image library when using the "Im" backend that utilizes  
ImageMagick's "convert" utility. It's not exploitable through any  
Horde application, because the code path to the vulnerability is not  
used by any Horde code. Custom applications using the Horde_Image  
library might be affected though. This vulnerability affects all  
versions of Horde_Image from 2.0.0 to 2.5.1.

A fixed version of the Horde_Image (version 2.5.2) library has already  
been released and everybody is advised to upgrade to Horde_Image 2.5.2  
as soon as possible.

Thanks to long-time contributor and supporter Thomas Jarosch  
<thomas.jarosch@...ra2net.com> for discovering and reporting these  
vulnerabilities.

--
Jan Schneider
The Horde Project
https://www.horde.org/
-----------------------------------

Timeline:
2017-09-15: Found the issue during manual code review
            after the recent CVE-2017-9773 issue.

2017-09-15: Sent patch to security@...de.org

2017-09-16: Checked horde code base if any horde core
            application exposes the vulnerable API.

2017-09-19: Wrote to security@...de.org again
            that the security risk for core horde apps is low,
            no embargo via linux-distros@ needed.

2017-09-19: Fix is committed to git.

2017-09-21: Release of fixed version 2.5.2 by the Horde project.

Thanks to Jan Schneider of the Horde project
for the timely release of the fixed version.

Best regards,
Thomas Jarosch / Intra2net AG

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.