CVE-2011-4078: Medium severity barnraiser aroundme vulnerability
Published Nov 3, 2011
·Updated
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.
Affected Software
28 affected components
Roundcube Webmail<=0.5.4
Roundcube Webmail=0.1
Roundcube Webmail=0.1-alpha
Roundcube Webmail=0.1-beta
Roundcube Webmail=0.1-beta2
Roundcube Webmail=0.1-rc1
Roundcube Webmail=0.1-rc2
Roundcube Webmail=0.1.1
Roundcube Webmail=0.2
Roundcube Webmail=0.2-alpha
Roundcube Webmail=0.2-beta
Roundcube Webmail=0.2.1
Roundcube Webmail=0.3
Roundcube Webmail=0.3-beta
Roundcube Webmail=0.3-rc1
Roundcube Webmail=0.3.1
Roundcube Webmail=0.4
Roundcube Webmail=0.4-beta
Roundcube Webmail=0.4.1
Roundcube Webmail=0.4.2
Roundcube Webmail=0.5
Roundcube Webmail=0.5-beta
Roundcube Webmail=0.5-rc
Roundcube Webmail=0.5.1
Roundcube Webmail=0.5.2
Roundcube Webmail=0.5.3
PHP PHP=5.3.7
PHP PHP=5.3.8
Remediation
Patch Available
Patch Available
Event History
Nov 3, 2011
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Data Sourced
03:55 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-4078?
CVE-2011-4078 is classified as a denial of service vulnerability.
2
How do I fix CVE-2011-4078?
To mitigate CVE-2011-4078, upgrade Roundcube Webmail to version 0.5.5 or later.
3
What versions of Roundcube Webmail are affected by CVE-2011-4078?
CVE-2011-4078 affects Roundcube Webmail versions 0.5.4 and earlier.
4
Does CVE-2011-4078 affect PHP versions?
CVE-2011-4078 occurs when using PHP versions 5.3.7 and 5.3.8.
5
What type of attack does CVE-2011-4078 enable?
CVE-2011-4078 allows remote attackers to exhaust resources and potentially cause inbox outages.