From: "Gerald Quakenbush" <geraldq@mastermindsecuritygroup.com.>
To: [email protected]Subject: eGroupWare Leaks Files
Date: Tue, 12 Apr 2005 10:53:34 -0500
Message-ID: <20050412.e3t.03409100@mail.mastermindsecuritygroup.com.>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
X-Mailer: AngleMail for eGroupWare (http://www.egroupware.org) v 1.0.0.001
X-Virus-Scanned: antivirus-gw at tyumen.ru
MasterMind Security Group, Inc.
Security Brief
Date: April 7, 2005
Contact: Gerald Quakenbush <geraldq AT mastermindsecuritygroup.com>
Severity: Moderate to Serious
Product: Confirmed in eGroupWare 1.001 and 1.006
Synopsis
========
The eGroupWare open-source software (www.egroupware.org) has a flaw that could
expose confidential information.
The eGroupWare suite provides many applications via a web interface. One such
application is for email. A flaw in this application could result in the
unwitting disclosure of files.
If a user composes a message and attaches a file, then decides not to send the
message, the attachment will get sent to the next person the user emails.
There is no indication in the message window that the file from the previous
message is still attached, unless the user clicks on the button to attach a
file to the second message.
Mitigation
==========
Until a patch is issued to resolve the problem, be aware of this issue. If you
attach a file to a message and then decide not to send it, logout of
eGroupWare then log back on before sending any new messages.
Walk Through
============
Login to eGroupWare using an account that has email configured.
Step 1. After logging in, select the email icon on the tool bar.
Step 2. Click the Compose button to create a new message and attach a file. Do
NOT click Send.
Step 3. Without sending the message, return to the inbox. You can click the
inbox link on the left of the email icon on the toolbar.
Step 4. You are now back at the main inbox screen. Click on the Compose link
again.
Step 5. Enter an email address (a personal account or one of a trusted friend,
preferably), a subject and brief message if you like and click Send.
Step 6. Now check the email for the account you sent the message to above. The
attachment from the canceled message in step 2 will be attached.
-Quake
--
------------------------------------
Gerald Quakenbush, CISSP, NSA-IAM
MasterMind Security Group, Inc.
888.295.6012 x701
http://www.mastermindsecuritygroup.com
