Horde IMP Message Attachment Symbolic Link Vulnerability

(courtesy Jarno Huuskonen <Jarno.Huuskonen@uku.fi>)
Upgrade to imp-2.2.5 and use the 'upload_tmp_dir' directive (php.ini) to define a directory where uploaded files should go (see imp/docs/SECURITY for more information).

Note: Imp-2.2.5 uses the PHP tempnam function for creating temporary files. With PHP versions earlier than 4.0.3? the tempnam function doesn't use mkstemp (so it has a race condition) so upgrading to PHP-4.0.5 or patching PHP-3.0.18 to use mkstemp is advisable[4].

Horde Project IMP 2.0

Horde Project IMP 2.2

Horde Project IMP 2.2.1

Horde Project IMP 2.2.2

Horde Project IMP 2.2.3

Horde Project IMP 2.2.4


Privacy Statement
Copyright 2010, SecurityFocus