oss-security - CVE Request for Horde and Squirrelmail

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 20 May 2010 15:04:23 +0200
From: Max Olsterd <max.olsterd@...il.com>
To: oss-security@...ts.openwall.com
Cc: security-2010@...irrelmail.org, security@...de.org
Subject: CVE Request for Horde and Squirrelmail

Hi,

Is there a CVE number available for the two 0-days exposed during Hack In
The Box Dubai 2010 ?

Though the exploits were not given during HITB (?), some friends have
recently shown me that they found how both products (Squirrelmail and Horde)
might be abused to be transformed, so that they become some kind of nmap
scanner (banner grab, port scan, etc). It helps at discovering a remote DMZ,
internal LAN, etc, by using those webmails as evil internal nmap proxies.

More info available on the slides of the corporate hackers who found the
0-days :
http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf
-> Squirrelmail: page 69 (post auth vuln)
-> Horde: page 74 (pre auth vuln)

Regards,

M@X

NB: Useful links :

SquirrelMail: http://www.squirrelmail.org (one of the most excellent Webmail
/ Opensource)
Horde: http://www.horde.org (one of the most excellent Webmail Opensource)
TEHTRI-Security: http://www.tehtri-security.com (seems to be some kind of
corporate hackers group / company ? who found some 0-days recently)
HITB: http://conference.hitb.org/ (HITB Security Conferences)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.