===================================================================== CERT-Renater Note d'Information No. 2004/VULN406 _____________________________________________________________________ DATE : 16/09/2004 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running egroupware versions prior to 1.0.00.004. ====================================================================== - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: eGroupWare: Multiple XSS vulnerabilities Date: September 02, 2004 Bugs: #61510 ID: 200409-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== The eGroupWare software contains multiple cross site scripting vulnerabilities. Background ========== eGroupWare is a suite of web-based group applications including calendar, address book, messenger and email. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-apps/egroupware <= 1.0.00.003 >= 1.0.00.004 Description =========== Joxean Koret recently discovered multiple cross site scripting vulnerabilities in various modules for the eGroupWare suite. This includes the calendar, address book, messenger and ticket modules. Impact ====== These vulnerabilities give an attacker the ability to inject and execute malicious script code, potentially compromising the victim's browser. Workaround ========== There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of eGroupWare. Resolution ========== All eGroupWare users should upgrade to the latest version: # emerge sync # emerge -pv ">=www-apps/egroupware-1.0.00.004" # emerge ">=www-apps/egroupware-1.0.00.004" References ========== [ 1 ] eGroupWare Announcement https://sourceforge.net/forum/forum.php?forum_id=401807 [ 2 ] Bugtraq Announcement http://www.securityfocus.com/archive/1/372603/2004-08-21/2004-08-27/0 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200409-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/1.0 ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================