Facebook
Twitter
D
DerFalk
Guest
What about a fix for Horde?
Look at this:
http://www.securityfocus.com/archive/1/489239/30/0/threaded
Look at this:
http://www.securityfocus.com/archive/1/489239/30/0/threaded
It seems Horde 3.1.7 fixes this: http://lists.horde.org/archives/announce/2008/000382.html
D
DerFalk
Guest
ok, but what can we do now? This fix is for Horde "standalone", what about the "Plesk-IMP"?
T
tiramisu_
Guest
a fix for 8.3 was requested from Plesk development, so waiting for reply
permanently in 8.4 only
permanently in 8.4 only
B
buddaaa
Guest
is there any fix for horde 3.1.5 ? my plesk installation uses it:
# rpm -qa|grep horde
psa-horde-3.1.5-suse10.2.build83071218.20
T
tiramisu_
Guest
8.4 comes with 3.1.6
T
tiramisu_
Guest
should be available at the end of April
All versions up to and including 3.1.6 seem to be vulnerable, so I hope that is a patched version of Horde 3.1.6.
F
faris
Guest
It is not clear to me if this requires the attacker to login using genuine credentials or if no authentication is required.
Can anyone enlighten me please?
The patch appears simple but I don't want to apply it in case it breaks the Plesk-modified version.
Faris.
Can anyone enlighten me please?
The patch appears simple but I don't want to apply it in case it breaks the Plesk-modified version.
Faris.
B
buddaaa
Guest
so there is no fix right now ?
atomicturtle
Golden Pleskian
If you're using ASL, this does not effect you.
B
buddaaa
Guest
no i don't use it. which feature protects against the bug ?
D
DerFalk
Guest
For me as a hobby-server-user it´s too expensive...
But you ASL-Guys do a great job!!!
atomicturtle
Golden Pleskian
I believe the specific SQL injection rules that get it are 340013, and 340017. We've also got a virtual patch for it now, which doesnt have an ID number yet.
