REDHAT-BUG-1073618: Low severity zarafa webaccess vulnerability
Robert Scheck reported that Zarafa's WebAccess stored session information, including login credentials, on-disk in PHP session files. This session file would contain a user's username and password to the Zarafa IMAP server.
If Zarafa WebAccess was run on a shared hosting site (multiple web sites on the same server), and an administrator of another server, with the ability to upload arbitrary scripts to the server, they could use this to obtain these IMAP credentials due to both sites being run by the same Apache user, and the PHP session files being owned by the same.
In a non-shared hosting environment, or one using something like SuEXEC, where the PHP session files are owned by individual users on a per-site basis, this would not be an issue. In that case, only a local user able to read these files (either as root or as the user running the Apache web server) would be able to view the credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1073618?
The severity of REDHAT-BUG-1073618 is classified as high due to the exposure of sensitive login credentials in session files.
How do I fix REDHAT-BUG-1073618?
To fix REDHAT-BUG-1073618, it is recommended to update Zarafa WebAccess to the latest version that addresses this vulnerability.
What type of information is stored insecurely in REDHAT-BUG-1073618?
REDHAT-BUG-1073618 involves the insecure storage of user login credentials within PHP session files.
Who reported REDHAT-BUG-1073618?
REDHAT-BUG-1073618 was reported by Robert Scheck.
How does REDHAT-BUG-1073618 affect users?
Users of Zarafa WebAccess on shared hosting may have their usernames and passwords exposed to other users sharing the same server.