English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 76783 CVE descriptions
and 40246 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.51434
Category:Conectiva Local Security Checks
Title:Conectiva Security Advisory CLA-2003:690
Summary:Conectiva Security Advisory CLA-2003:690
Description:
The remote host is missing updates announced in
advisory CLA-2003:690.

Imp[1] is a webmail system which uses the Horde framework.

Jouko Pynnonen reported[3] that the Imp webmail version 2.x has a SQL
injection vulnerability[2].

Imp can optionally store user preferences, contacts list and session
IDs in a SQL database. A remote attacker can use this vulnerability
to execute SQL commands and possibly get session IDs and steal
another user's webmail session. Other consequences are possible and
depend on the privileges Imp has in the database. Usually, these
privileges are limited to the Imp database itself, but this is site
and database specific.

This update also contains some fixes for Imp and Horde to make them
work with PHP 4.3.2.


Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'

http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:690
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003

Risk factor : High
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2003-0025
Bugtraq: 20030108 IMP 2.x SQL injection vulnerabilities (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=104204786206563&w=2
Bugtraq: 20030108 Re: IMP 2.x SQL injection vulnerabilities (Google Search)
http://www.securityfocus.com/archive/1/306268
Debian Security Information: DSA-229 (Google Search)
http://www.debian.org/security/2003/dsa-229
SuSE Security Announcement: SuSE-SA:2003:0008 (Google Search)
BugTraq ID: 6559
http://www.securityfocus.com/bid/6559
http://www.securitytracker.com/id?1005904
http://secunia.com/advisories/8087
http://secunia.com/advisories/8177
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 40246 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.