Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.

High-Tech Bridge Security Research Lab discovered that Roundcube, a webmail client, contained a path traversal vulnerability. This flaw could be exploited by an attacker to access sensitive files on the server, or even execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-201603-03 (Roundcube: Multiple Vulnerabilities)

    Remote authenticated users with certain permissions can read arbitrary       files or possibly execute arbitrary code via .. in the _skin parameter to       index.php.  Additionally, a cross-site scripting (XSS) vulnerability in       program/js/app.js allows remote authenticated users to inject arbitrary       web script or HTML via the file name in a drag-n-drop file upload.
  Impact :

    A remote authenticated user could possibly execute arbitrary code with       the privileges of the process, inject arbitrary web scripts or HTML, read       arbitrary files, or perform XSS.
  Workaround :

    There is no known workaround at this time.

Update to 1.0.8

  - Add workaround for https://bugs.php.net/bug.php?id=70757     (#1490582)

  - Fix HTML sanitizer to skip  in     output (#1490583)

  - Fix charset encoding of message/rfc822 part bodies     (#1490606)

  - Fix handling of message/rfc822 attachments on replies     and forwards (#1490607)

  - Fix PDF support detection in Firefox > 19 (#1490610)

  - Fix path traversal vulnerability (CWE-22) in setting a     skin (#1490620) [CVE-2015-8770] [bnc#962067]

  - Fix so drag-n-drop of text (e.g. recipient addresses) on     compose page actually works (#1490619)

  - Fix .htaccess rewrite rules to not block .well-known     URIs (#1490615)

  - Updated apache2 config

This update to roundcubemail 1.0.8 fixes the following issues :

  - CVE-2015-8770: Path traversal vulnerability allowed code     execution to remote authenticated users if they were     also upload files to the same server through some other     method (boo#962067)

This update also contains all upstream fixes in 1.0.8. The package was updated to use generic PHP requirements for use with other prefixes than 'php5-'

This update to roundcubemail 1.1.4 fixes the following issues :

  - CVE-2015-8770: Path traversal vulnerability allowed code     execution to remote authenticated users if they were     also upload files to the same server through some other     method (boo#962067)

This update also contains all upstream fixes in 1.1.4. The package was updated to use generic PHP requirements for use with other prefixes than 'php5-'

High-Tech Bridge Security Research Lab discovered a path traversal vulnerability in a popular webmail client Roundcube. Vulnerability can be exploited to gain access to sensitive information and under certain circumstances to execute arbitrary code and totally compromise the vulnerable server.

The vulnerability exists due to insufficient sanitization of '_skin' HTTP POST parameter in '/index.php' script when changing between different skins of the web application. A remote authenticated attacker can use path traversal sequences (e.g. '../../') to load a new skin from arbitrary location on the system, readable by the webserver.

(sorry for first uploading a package with a wrong version 0.3.1-6+dab6u1)

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
90369	Debian DSA-3541-1 : roundcube - security update	Nessus	Debian Local Security Checks	high
89809	GLSA-201603-03 : Roundcube: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
88397	openSUSE Security Update : roundcubemail (openSUSE-2016-84)	Nessus	SuSE Local Security Checks	high
88164	openSUSE Security Update : roundcubemail (openSUSE-2016-81)	Nessus	SuSE Local Security Checks	high
88163	openSUSE Security Update : roundcubemail (openSUSE-2016-80)	Nessus	SuSE Local Security Checks	high
87976	Debian DLA-392-1 : roundcube security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-8770

high

Tenable Plugins

high

high

high

high

high

high