Re: [suse-security] [Fwd: IMP 2.2.7 (SECURITY) released]

I found the following message on Bugtraq. Is suse working on a fix for Suse EMail-Server II? The patch on the update-server is still 2.2.6.

It's known, and our email server maintainers are working on it.

Martin

"Brent J. Nordquist" wrote:

...

The Horde team announces the availability of IMP 2.2.7, which fixes a potential session hijacking vulnerability using a cross-site scripting (CSS) attack. We recommend that all sites running IMP 2.2.x upgrade to this version.

The Horde Project would like to thank João Pedro Gonçalves from the Phibernet Information Network for discovering this problem and alerting us. From his description:

...

- It's possible to hijack an imp/horde session using a cross-site script attack, quite similar to the one explored by Marc Slemko in his "Microsoft Passport to Trouble" paper.

- After hijacking the cookies, the attacker can use the session and read the victim's mail.

- All stable imp webmail versions, up to 2.2.6 including are vulnerable, the devel version, 2.3 and 3.0 Release Candidate 1 are not affected by this vulnerability.

This release also has a new Chinese (Simplified) translation.

Thanks, Roman. -- - - | Roman Drahtmüller // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -