----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Multiple Horde Products Security Bypass

SECUNIA ADVISORY ID:
SA28382

VERIFY ADVISORY:
http://secunia.com/advisories/28382/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
>From remote

SOFTWARE:
Turba 2.x (Horde module)
http://secunia.com/product/6450/
Nag 2.x (Horde module)
http://secunia.com/product/6452/
Mnemo 2.x (Horde module)
http://secunia.com/product/6449/
Kronolith 2.x (Horde module)
http://secunia.com/product/6453/
Horde Groupware Webmail Edition 1.x
http://secunia.com/product/17151/
Horde Application Framework 3.x
http://secunia.com/product/4524/
Horde Groupware 1.x
http://secunia.com/product/17152/

DESCRIPTION:
Some vulnerabilities have been reported in various Horde products,
which can be exploited by malicious people to bypass certain security
restrictions.

1) The Horde API does not properly restrict access to users with the
correct credentials. No further information is currently available.

This vulnerability is reported in Horde 3.1.5, Mnemo 2.1.1, Nag
2.1.3, Kronolith 2.1.6, Turba 2.1.5, Horde Groupware Webmail Edition
1.0.3, and Horde Groupware 1.0.2. Prior versions may also be
affected.

2) The share change functionality does not properly restrict access
to users with the correct credentials. No further information is
currently available.

This vulnerability is reported in Mnemo 2.1.1, Nag 2.1.3, Kronolith
2.1.6, Horde Groupware Webmail Edition 1.0.3, and Horde Groupware
1.0.2. Prior versions may also be affected.

SOLUTION:
Update to Horde 3.1.6, Mnemo 2.1.2, Nag 2.1.4, Kronolith 2.1.7, Turba
2.1.6, Horde Groupware Webmail Edition 1.0.4, and Horde Groupware
1.0.3.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------