CVE-2017-7413 : Security Advisory and Response

Horde_Crypt before 2.7.6 is vulnerable to OS Command Injection, impacting Horde Groupware Webmail Edition up to version 5.2.17.

Understanding CVE-2017-7413

What is CVE-2017-7413?

In previous versions of Horde_Crypt before 2.7.6, a vulnerability known as OS Command Injection exists. This vulnerability can be exploited in Horde Groupware Webmail Edition up to version 5.2.17.

The Impact of CVE-2017-7413

The exploit requires the attacker to be an authenticated user of Horde Webmail, have the PGP features enabled in their preferences, and try to encrypt an email that is intended for a deliberately manipulated email address.

Technical Details of CVE-2017-7413

Vulnerability Description

OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.

Affected Systems and Versions

Product: n/a
Vendor: n/a
Versions: Up to Horde Groupware Webmail Edition 5.2.17

Exploitation Mechanism

Attacker must be an authenticated user of Horde Webmail
Attacker must have PGP features enabled in their preferences
Attacker must attempt to encrypt an email to a manipulated email address

Mitigation and Prevention

Immediate Steps to Take

Update Horde_Crypt to version 2.7.6 or later
Disable PGP features in Horde Webmail preferences if not needed

Long-Term Security Practices

Regularly monitor and audit email encryption activities
Educate users on email security best practices

Patching and Updates

Apply security updates and patches promptly to all affected systems