• info
• discussion
• exploit
• solution
• references

Horde IMP Session Hijacking Vulnerability

Solution:
It has been reported that the devel version of Horde IMP and Horde IMP 3.0 Release Candidate 1 are not vulnerable to this issue.

It is advised to upgrade to Imp 2.2.7.

Additional upgrades are available.


Horde Project IMP 2.0

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.1

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.2

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.3

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.4

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.5

• Horde IMP 2.2.7
  http://www.horde.org/imp/download/

Horde Project IMP 2.2.6

• Conectiva 5.0 noarch horde-1.2.7-1U50_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/noarch/horde-1.2.7-1U50_1cl.no arch.rpm


• Conectiva 5.0 noarch horde-mysql-1.2.7-1U50_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/noarch/horde-mysql-1.2.7-1U50_ 1cl.noarch.rpm


• Conectiva 5.0 noarch horde-pgsql-1.2.7-1U50_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/noarch/horde-pgsql-1.2.7-1U50_ 1cl.noarch.rpm


• Conectiva 5.0 noarch horde-shm-1.2.7-1U50_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/noarch/horde-shm-1.2.7-1U50_1c l.noarch.rpm


• Conectiva 5.0 noarch imp-2.2.7-1U50_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/noarch/imp-2.2.7-1U50_1cl.noar ch.rpm


• Conectiva 5.1 noarch horde-1.2.7-1U51_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/noarch/horde-1.2.7-1U51_1cl.no arch.rpm


• Conectiva 5.1 noarch horde-mysql-1.2.7-1U51_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/noarch/horde-mysql-1.2.7-1U51_ 1cl.noarch.rpm


• Conectiva 5.1 noarch horde-pgsql-1.2.7-1U51_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/noarch/horde-pgsql-1.2.7-1U51_ 1cl.noarch.rpm


• Conectiva 5.1 noarch horde-shm-1.2.7-1U51_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/noarch/horde-shm-1.2.7-1U51_1c l.noarch.rpm


• Conectiva 5.1 noarch imp-2.2.7-1U51_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/noarch/imp-2.2.7-1U51_1cl.noar ch.rpm


• Conectiva 6.0 horde-1.2.7-1U60_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/horde-1.2.7-1U60_1cl.noar ch.rpm


• Conectiva 6.0 horde-mysql-1.2.7-1U60_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/horde-mysql-1.2.7-1U60_1c l.noarch.rpm


• Conectiva 6.0 horde-pgsql-1.2.7-1U60_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/horde-pgsql-1.2.7-1U60_1c l.noarch.rpm


• Conectiva 6.0 horde-shm-1.2.7-1U60_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/horde-shm-1.2.7-1U60_1cl. noarch.rpm


• Conectiva 6.0 imp-2.2.7-1U60_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/imp-2.2.7-1U60_1cl.noarch .rpm


• Conectiva 7.0 horde-1.2.7-1U70_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-1.2.7-1U70_1cl.noar ch.rpm


• Conectiva 7.0 horde-mysql-1.2.7-1U70_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-mysql-1.2.7-1U70_1c l.noarch.rpm


• Conectiva 7.0 horde-pgsql-1.2.7-1U70_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-pgsql-1.2.7-1U70_1c l.noarch.rpm


• Conectiva 7.0 horde-shm-1.2.7-1U70_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/horde-shm-1.2.7-1U70_1cl. noarch.rpm


• Conectiva 7.0 imp-2.2.7-1U70_1cl.noarch.rpm
  ftp://atualizacoes.conectiva.com.br/7.0/RPMS/imp-2.2.7-1U70_1cl.noarch .rpm


• Horde IMP 2.2.7
  http://www.horde.org/imp/download/