steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.

roundcubemail was updated to 0.9.5 to fix bugs and security issues.

Fixed security issues :

  - CVE-2013-6172: vulnerability in handling _session     argument of utils/save-prefs

New upstream release 0.9.5 (bnc#847179) (CVE-2013-6172)

  - Fix failing vCard import when email address field     contains spaces

  - Fix default spell-check configuration after Google     suspended their spell service

  - Fix vulnerability in handling _session argument of     utils/save-prefs

  - Fix iframe onload for upload errors handling

  - Fix address matching in Return-Path header on identity     selection

  - Fix text wrapping issue with long unwrappable lines

  - Fixed mispelling: occured -> occurred

  - Fixed issues where HTML comments inside style tag would     hang Internet Explorer

  - Fix setting domain in virtualmin password driver

  - Hide Delivery Status Notification option when     smtp_server is unset

  - Display full attachment name using title attribute when     name is too long to display

  - Fix attachment icon issue when rare font/language is     used

  - Fix expanded thread root message styling after     refreshing messages list

  - Fix issue where From address was removed from Cc and Bcc     fields when editing a draft

  - Fix error_reporting directive check

  - Fix de_DE localization of 'About' label in Help plugin

The remote host is affected by the vulnerability described in GLSA-201402-15 (Roundcube: Arbitrary code execution)

    A vulnerability in steps/utils/save_pref.inc allows remote attackers to       use the _session parameter to change configuration settings.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, inject SQL code, or read arbitrary files.
  Workaround :

    There is no known workaround at this time.

Roundcubemail just released new 0.9.5 version with fixes for VCE2013-6172(will be available soon).

Hotfix:
https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff

Full announcement :

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered and corrected in roundcubemail :

It was discovered that roundcube does not properly sanitize the
_session parameter in steps/utils/save_pref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing random file access, manipulated SQL queries and even code execution (CVE-2013-6172).

The updated packages have been patched to correct this issue.

It was discovered that roundcube, a skinnable AJAX based webmail solution for IMAP servers, does not properly sanitize the _session parameter in steps/utils/save_pref.inc during saving preferences. The vulnerability can be exploited to overwrite configuration settings and subsequently allowing random file access, manipulated SQL queries and even code execution.

roundcube in the oldstable distribution (squeeze) is not affected by this problem.

ID	Name	Product	Family	Severity
75292	openSUSE Security Update : roundcubemail (openSUSE-SU-2014:0365-1)	Nessus	SuSE Local Security Checks	high
72452	GLSA-201402-15 : Roundcube: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
70823	Fedora 20 : roundcubemail-0.9.5-1.fc20 (2013-19699)	Nessus	Fedora Local Security Checks	high
70700	Fedora 18 : roundcubemail-0.9.5-1.fc18 (2013-19745)	Nessus	Fedora Local Security Checks	high
70689	Mandriva Linux Security Advisory : roundcubemail (MDVSA-2013:263)	Nessus	Mandriva Local Security Checks	high
70652	Debian DSA-2787-1 : roundcube - design error	Nessus	Debian Local Security Checks	high
70645	Fedora 19 : roundcubemail-0.9.5-1.fc19 (2013-19729)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-6172

critical

Tenable Plugins

high

high

high

high

high

high

high