GLSA 201612-44: Roundcube: Arbitrary code execution

http://security.gentoo.org/

Severity:	normal
Title:	Roundcube: Arbitrary code execution
Date:	12/24/2016
Bugs:	#601410
ID:	201612-44

Synopsis

A vulnerability in Roundcube could potentially lead to arbitrary code execution.

Background

Free and open source webmail software for the masses, written in PHP.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
mail-client/roundcube	< 1.2.3	>= 1.2.3	All supported architectures

Description

Roundcube, when no SMTP server is configured and the sendmail program is enabled, does not properly restrict the use of custom envelope-from addresses on the sendmail command line.

Impact

An authenticated remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.

Workaround

Don’t use a MTA (Mail Transfer Agent) in conjunction with Roundcube which implements sendmail’s “-O” or “-X” parameter, or configure Roundcube to use a SMTP server as recommended by upstream.

Resolution

All Roundcube users should upgrade to the latest version:

      # emerge --sync
      # emerge --ask --oneshot --verbose ">=mail-client/roundcube-1.2.3"

References

CVE-2016-9920

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201612-44.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.