[Secure-testing-team] Bug#573279: egroupware: 2 critial security bugs - remotely exploitable - without login

[Eneko Lacunza]

Package: egroupware
Version: 1.6.002+dfsg-1~bpo50+1
Severity: critical
Tags: security
Justification: -1


1.6.003 has been published fixing 2 critical security bugs:
http://www.egroupware.org/Home?category_id=95&item=93

In a debian-standard apache setup, "only" www-data user/group accesible files and commands are compromised.

Update fixes a load of other non-security bugs and adds some new features too.

Affected versions include all < 1.6.003 .


-- System Information:
Debian Release: 5.0.4
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-2-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages egroupware depends on:
ii  egroupware-addres 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - addres
ii  egroupware-bookma 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - bookma
ii  egroupware-calend 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - calend
ii  egroupware-core   1.6.002+dfsg-1~bpo50+1 web-based groupware suite - core m
ii  egroupware-develo 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - develo
ii  egroupware-emaila 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - e-mail
ii  egroupware-etempl 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - widget
ii  egroupware-felami 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - e-mail
ii  egroupware-filema 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - file m
ii  egroupware-infolo 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - infolo
ii  egroupware-manual 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - manual
ii  egroupware-news-a 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - news a
ii  egroupware-notifi 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - notifi
ii  egroupware-phpbra 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - phpbra
ii  egroupware-phpsys 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - phpSys
ii  egroupware-polls  1.6.002+dfsg-1~bpo50+1 web-based groupware suite - pollin
ii  egroupware-projec 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - projec
ii  egroupware-regist 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - regist
ii  egroupware-resour 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - resour
ii  egroupware-sambaa 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - Samba 
ii  egroupware-sitemg 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - site m
ii  egroupware-timesh 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - timesh
ii  egroupware-tracke 1.6.002+dfsg-1~bpo50+1 web-based groupware suite - tracke
ii  egroupware-wiki   1.6.002+dfsg-1~bpo50+1 web-based groupware suite - wiki a

egroupware recommends no packages.

egroupware suggests no packages.

-- no debconf information