|Category:||Conectiva Local Security Checks|
|Title:||Conectiva Security Advisory CLA-2003:690|
The remote host is missing updates announced in
Imp is a webmail system which uses the Horde framework.
Jouko Pynnonen reported that the Imp webmail version 2.x has a SQL
Imp can optionally store user preferences, contacts list and session
IDs in a SQL database. A remote attacker can use this vulnerability
to execute SQL commands and possibly get session IDs and steal
another user's webmail session. Other consequences are possible and
depend on the privileges Imp has in the database. Usually, these
privileges are limited to the Imp database itself, but this is site
and database specific.
This update also contains some fixes for Imp and Horde to make them
work with PHP 4.3.2.
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
Risk factor : High
Common Vulnerability Exposure (CVE) ID: CVE-2003-0025|
Bugtraq: 20030108 IMP 2.x SQL injection vulnerabilities (Google Search)
Bugtraq: 20030108 Re: IMP 2.x SQL injection vulnerabilities (Google Search)
Debian Security Information: DSA-229 (Google Search)
SuSE Security Announcement: SuSE-SA:2003:0008 (Google Search)
BugTraq ID: 6559
|Copyright||Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com|
|This is only one of 68714 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.