bugphpGroupWare - Bugs: bug #24725, Security vulnerability in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #24725: Security vulnerability in class.phpmailer.inc.php

Submitted by:  Olivier Berger <olberger>
Submitted on:  Sun 02 Nov 2008 08:26:18 AM UTC  
 
Item Group: 0.9.16.012Category: felamimail
Severity: 3 - NormalPriority: 7 - High
Status: InvalidPrivacy: Public
Assigned to: Dave Hall <skwashd>Open/Closed: Closed
Component Version: NoneOperating System: None
Reproducibility: NonePlanned Release: None
Fixed Release: 

Mon 10 Nov 2008 12:43:38 AM UTC, comment #3:

There is no way of exploiting this vulnerability from within phpGroupWare as we only use smtp. We don't call the use of sendmail.

The version of PHPMailer in trunk is already updated to a new version. In stable it seems to make little sense as we don't use the vulnerable code.

Dave Hall <skwashd>
Project AdministratorIn charge of this item.
Wed 05 Nov 2008 10:50:56 PM UTC, comment #2:

<skwashd> phpgw isn't vunerable to the attack
<skwashd> we only use smtp (AFAIK)
<skwashd> at least in the API version

... didn't check myself, and skwashd seems busy with machine outages at the moment...

HtH anyway.

Olivier Berger <olberger>
Sun 02 Nov 2008 04:51:03 PM UTC, comment #1:

See proposed patch at : http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=13;filename=class.phpmailer.inc.php.patch;att=1;bug=504255

Of course there are updated versions of phpmailer that may be preferred should you want to fix this.

Hope this helps,

Best regards,

Olivier Berger <olberger>
Sun 02 Nov 2008 08:26:18 AM UTC, original submission:

FYI, a bugreport was filed on phpgroupware in Debian about a security vulnerability in the copy of class.phpmailer.inc.php which is embedded in felamimail.

Here's the report : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504255

Hope this helps.

Best regards,

Olivier Berger <olberger>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by skwashd (Posted a comment)
  • -unavailable- added by olberger (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 10 Nov 2008 12:43:38 AM UTCskwashdStatusNone=>Invalid
      Assigned toNone=>skwashd
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1