WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

Updated zarafa packages fix security vulnerabilities :

Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448, CVE-2014-5449, CVE-2014-5450).

Zarafa Collaboration Platform 7.1.10 final [44973] ==================================================

General

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
77839	Mandriva Linux Security Advisory : zarafa (MDVSA-2014:182)	Nessus	Mandriva Local Security Checks	low
76860	Fedora 20 : zarafa-7.1.10-2.fc20 (2014-7896)	Nessus	Fedora Local Security Checks	low
76859	Fedora 19 : zarafa-7.1.10-2.fc19 (2014-7889)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2014-0103

medium

Tenable Plugins

low

low

low