CVE-2010-0463: Infoleak

Q: What is the severity of CVE-2010-0463?

CVE-2010-0463 has a medium severity rating due to its potential to expose webmail users' network locations to remote attackers.

Q: How do I fix CVE-2010-0463?

To mitigate CVE-2010-0463, users should upgrade Horde IMP to version 4.3.7 or later, which addresses the DNS prefetching vulnerability.

Q: What versions of Horde IMP are affected by CVE-2010-0463?

CVE-2010-0463 affects all versions of Horde IMP from 4.3.6 and earlier, including multiple 3.x and 2.x versions.

Q: What is the impact of CVE-2010-0463 on users?

CVE-2010-0463 allows attackers to learn the network location of users through logged DNS requests caused by email domain prefetching.

Q: Is there a workaround for CVE-2010-0463?

A temporary workaround for CVE-2010-0463 can involve disabling DNS prefetching in the web browser settings until the software is updated.

Published Jan 29, 2010

Updated

Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.

Affected Software

41 affected components

Horde IMP<=4.3.6

Horde IMP=2.0

Horde IMP=2.2

Horde IMP=2.2.1

Horde IMP=2.2.2

Horde IMP=2.2.3

Horde IMP=2.2.4

Horde IMP=2.2.5

Horde IMP=2.2.6

Horde IMP=2.2.7

Horde IMP=2.2.8

Horde IMP=2.3

Horde IMP=3.0

Horde IMP=3.1

Horde IMP=3.1.2

Horde IMP=3.2

Horde IMP=3.2.1

Horde IMP=3.2.2

Horde IMP=3.2.3

Horde IMP=3.2.4

Horde IMP=3.2.5

Horde IMP=3.2.6

Horde IMP=3.2.7

Horde IMP=3.2.7-rc1

Horde IMP=4.0

Horde IMP=4.0.1

Horde IMP=4.0.2

Horde IMP=4.0.3

Horde IMP=4.0.4

Horde IMP=4.1.3

Horde IMP=4.1.5

Horde IMP=4.1.6

Horde IMP=4.2

Horde IMP=4.2.1

Horde IMP=4.2.2

Horde IMP=4.3

Horde IMP=4.3.1

Horde IMP=4.3.2

Horde IMP=4.3.3

Horde IMP=4.3.4

Horde IMP=4.3.5

Remediation

Patch Available

http://bugs.horde.org/ticket/8836

Event History

Jan 29, 2010

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-0463?

CVE-2010-0463 has a medium severity rating due to its potential to expose webmail users' network locations to remote attackers.

How do I fix CVE-2010-0463?

To mitigate CVE-2010-0463, users should upgrade Horde IMP to version 4.3.7 or later, which addresses the DNS prefetching vulnerability.

What versions of Horde IMP are affected by CVE-2010-0463?