ArchLinux: 201711-27: roundcubemail: arbitrary filesystem access
Summary
Roundcube Webmail 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Resolution
Upgrade to 1.3.3-1.
# pacman -Syu "roundcubemail>=1.3.3-1"
The problem has been fixed upstream in version 1.3.3.
References
https://github.com/roundcube/roundcubemail/commit/c90ad5a97784fb32683b8e3c21d6c95baab6d806 https://github.com/roundcube/roundcubemail/issues/6026 https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10 https://security.archlinux.org/CVE-2017-16651
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.