services/go.php in Horde Application Framework 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1 does not properly restrict its image proxy capability, which allows remote attackers to perform "Web tunneling" attacks and use the server as a proxy via (1) http, (2) https, and (3) ftp URL in the url parameter, which is requested from the server.

Several remote vulnerabilities have been discovered in the Horde web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-3548     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-3549     Moritz Naumann discovered that Horde does not properly     restrict its image proxy, allowing remote attackers to     use the server as a proxy.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2006-4256     Marc Ruef discovered that Horde allows remote attackers     to include web pages from other sites, which could be     useful for phishing attacks.

      This vulnerability applies to oldstable (sarge) only.

  - CVE-2007-1473     Moritz Naumann discovered that Horde allows remote     attackers to inject arbitrary web script or HTML in the     context of a logged in user (cross site scripting).

      This vulnerability applies to both stable (etch) and oldstable       (sarge).

  - CVE-2007-1474     iDefense discovered that the cleanup cron script in     Horde allows local users to delete arbitrary files.

      This vulnerability applies to oldstable (sarge) only.

This update fixes the following two security issues in the Horde Application Framework :

  - CVE-2006-3548: Multiple cross-site scripting (XSS)     vulnerabilities allow remote attackers to inject     arbitrary web script or HTML via a (1) JavaScript URI or     an external (2) http, (3) https, or (4) ftp URI in the     url parameter in services/go.php (aka the dereferrer),     (5) a JavaScript URI in the module parameter in     services/help (aka the help viewer), and (6) the name     parameter in services/problem.php (aka the problem     reporting screen).

  - CVE-2006-3549: services/go.php does not properly     restrict its image proxy capability, which allows remote     attackers to perform 'Web tunneling' attacks and use the     server as a proxy via (1) http, (2) https, and (3) ftp     URL in the url parameter, which is requested from the     server.

The version of Horde installed on the remote host fails to validate input to the 'url' parameter of the 'services/go.php' script before using it in dynamically-generated content.  An unauthenticated attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser. 

In addition, similar cross-site scripting issues reportedly exist with the 'module' parameter of the 'services/help/index.php' script and the 'name' parameter of the 'services/problem.php' script.

ID	Name	Product	Family	Severity
28151	Debian DSA-1406-1 : horde3 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
27265	openSUSE 10 Security Update : horde (horde-1868)	Nessus	SuSE Local Security Checks	medium
22004	Horde < 3.0.11 / 3.1.2 Multiple Script XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2006-3549

critical

Tenable Plugins

medium

medium

medium