----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
IMP Mail Deletion Security Bypass Vulnerability

SECUNIA ADVISORY ID:
SA28020

VERIFY ADVISORY:
http://secunia.com/advisories/28020/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Cross Site Scripting, Manipulation of data

WHERE:
>From remote

SOFTWARE:
IMP Webmail Client 4.x
http://secunia.com/product/6376/
Horde Application Framework 3.x
http://secunia.com/product/4524/
Horde Groupware Webmail Edition 1.x
http://secunia.com/product/17151/

DESCRIPTION:
Secunia Research has discovered a vulnerability in IMP Webmail Client
and Horde Groupware Webmail Edition, which can be exploited by
malicious people to bypass certain security restrictions and
manipulate data.

The HTML filter does not filter out <frame> and <frameset> HTML
elements. Additionally, the application allows users to perform
certain actions via HTTP requests without performing any validity
checks to verify the request. This can be exploited to (a) delete an
arbitrary number of e-mail messages by referencing their numeric IDs
and (b) purge deleted mails, when the victim opens a malicious HTML
mail.

Successful exploitation requires that the victim opens the HTML part
of a malicious message.

The vulnerability is confirmed in IMP version 4.1.5 with Horde
version 3.1.5 and also reported in Horde Groupware Webmail Edition
1.0.3. Other versions may also be affected.

SOLUTION:
Update to Horde version 3.1.6 or Horde Groupware Webmail Edition
1.0.4.

PROVIDED AND/OR DISCOVERED BY:
Ulf Harnhammar, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2007-102/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------