Bugzilla – Bug 1082822
VUL-0: CVE-2018-1000071,CVE-2018-1000072: roundcubemail: Permissions issue in enigma plugin allows exfiltration of secret gpg key file
Last modified: 2019-07-11 14:57:31 UTC
rh#1549054 Enigma plugin in roundcube installation running on nginx web server is vulnerable to insecure permissions due to which a remote attacker is able to exfiltrate user's password protected secret GPG key file using a specially crafted URL. Affected versions: before 1.3.4 => Leap 42.3 References: https://github.com/roundcube/roundcubemail/issues/6173 https://www.legacysecuritygroup.com/cve/references/02122018-roundcube-enigma.txt https://bugzilla.redhat.com/show_bug.cgi?id=1549054 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000071
Leap 42.3 has 1.1.9 /srv/www/roundcubemail/plugins/enigma has root:root 755 and is in the web tree. This was actually NOT fixed in the upstream release. This path was touched: +# RW need for PGP plugin +%attr(0700, wwwrun, root) %dir %{roundcubepath}/plugins/enigma/home https://build.opensuse.org/request/show/577173 Joop, Eric, are one of you able to please: * verify affectedness for server:php:applications/roundcubemail 1.3.4? * if affected fix it * suggest a maintenance update?
server:php:applications/roundcubemail actually has maintainers...
(In reply to Andreas Stieger from comment #2) > Leap 42.3 has 1.1.9 > /srv/www/roundcubemail/plugins/enigma has root:root 755 and is in the web > tree. > > This was actually NOT fixed in the upstream release. This path was touched: This is no security risc, because with root:root you can not use this plugin. Apache must have write rights to save and generate keys. With root:root apache can not do this.
(In reply to Eric Schirra from comment #4) > This is no security risc, because with root:root you can not use this plugin. > Apache must have write rights to save and generate keys. > With root:root apache can not do this. Are you sure? The vulnerability is about remote attackers reading confidential files due to them being web readable and in the web tree, which is the case here.
(In reply to Andreas Stieger from comment #5) > (In reply to Eric Schirra from comment #4) > > This is no security risc, because with root:root you can not use this plugin. > > Apache must have write rights to save and generate keys. > > With root:root apache can not do this. > > Are you sure? The vulnerability is about remote attackers reading > confidential files due to them being web readable and in the web tree, which > is the case here. In devel, factory (Tumbleweed) and Leap 15.0 there is: # RW need for PGP plugin %attr(0700, wwwrun, root) %dir %{roundcubepath}/plugins/enigma/home So. Only wwwrun can rwx. And without this rights, the enigma-plugin can not be use. I think this is secure enough. And you can change the dir manuell to other location. We can put only this plugin outside the normal roundcube path. But why? And this will be not clearly and logical, because all other plugins are under roundcubepath.
It just seems logical to have plugin temporary and database data outside of the web tree.
(In reply to Andreas Stieger from comment #7) > It just seems logical to have plugin temporary and database data outside of > the web tree. Sorry. I can do nothing at the moment. Because roundcube itself has trouble. For this is an other bug report open. Must wait if the roundcubemail bug is fixed. After that i can do changes and test it.
This is automated batch bugzilla cleanup. The openSUSE 42.3 changed to end-of-life (EOL [1]) status. As such it is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of openSUSE (At this moment openSUSE Leap 15.1, 15.0 and Tumbleweed) please feel free to reopen this bug against that version (!you must update the "Version" component in the bug fields, do not just reopen please), or alternatively create a new ticket. Thank you for reporting this bug and we are sorry it could not be fixed during the lifetime of the release. [1] https://en.opensuse.org/Lifetime
15.0 has 1.3.6 -> fixed