--nextPart2518244.Upa1o7Of3b

Content-Type: text/plain;

  charset="us-ascii"

Content-Transfer-Encoding: 7bit

Content-Disposition: inline



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200611-22

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: Normal

     Title: Ingo H3: Folder name shell command injection

      Date: November 27, 2006

      Bugs: #153927

        ID: 200611-22



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



Ingo H3 is vulnerable to arbitrary shell command execution when

handling procmail rules.



Background

==========



Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and

IMAP filter rules.



Affected packages

=================



    -------------------------------------------------------------------

     Package              /  Vulnerable  /                  Unaffected

    -------------------------------------------------------------------

  1  www-apps/horde-ingo       < 1.1.2                        >= 1.1.2



Description

===========



Ingo H3 fails to properly escape shell metacharacters in procmail

rules.



Impact

======



A remote authenticated attacker could craft a malicious rule which

could lead to the execution of arbitrary shell commands on the server.



Workaround

==========



Don't use procmail with Ingo H3.



Resolution

==========



All Ingo H3 users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=www-apps/horde-ingo-1.1.2"



References

==========



  [ 1 ] CVE-2006-5449

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5449



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200611-22.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2006 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.5



--nextPart2518244.Upa1o7Of3b

Content-Type: application/pgp-signature



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.5 (GNU/Linux)



iD8DBQBFapyqzKC5hMHO6rkRAkMLAJ9Ng1TjKfGMuUmkjzAmyT3yHX3GigCfbPnX

a/mxH+yBD3RNdLOBxdvOyQE=

=JNPh

-----END PGP SIGNATURE-----



--nextPart2518244.Upa1o7Of3b--

-- 

gentoo-announce@gentoo.org mailing list