—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:182
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : zarafa
Date : September 24, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated zarafa packages fix security vulnerabilities:

Robert Scheck reported that Zarafa's WebAccess stored session
information, including login credentials, on-disk in PHP session
files. This session file would contain a user's username and password
to the Zarafa IMAP server (CVE-2014-0103).

Robert Scheck discovered that the Zarafa Collaboration Platform has
multiple incorrect default permissions (CVE-2014-5447, CVE-2014-5448,
CVE-2014-5449, CVE-2014-5450).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0103
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5447
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5448
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5449
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5450
http://advisories.mageia.org/MGASA-2014-0380.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
b574e9d3829a2083e0ab6f18f0c03d6e mbs1/x86_64/lib64zarafa0-7.1.8-1.1.mbs1.x86_64.rpm
3428bccf076a0415a5fcd3a8711d954c mbs1/x86_64/lib64zarafa-devel-7.1.8-1.1.mbs1.x86_64.rpm
3008870b6138647ece3e000f36b6e964 mbs1/x86_64/php-mapi-7.1.8-1.1.mbs1.x86_64.rpm
e40348366d018a89a729ee4301c957c4 mbs1/x86_64/python-MAPI-7.1.8-1.1.mbs1.x86_64.rpm
48d737652190a274fabdcf2f6d2718ff mbs1/x86_64/zarafa-7.1.8-1.1.mbs1.x86_64.rpm
6e19f61e06ea0636e60457557217780e mbs1/x86_64/zarafa-archiver-7.1.8-1.1.mbs1.x86_64.rpm
dd43d8a343ca593d19c38bfd99b4a933 mbs1/x86_64/zarafa-caldav-7.1.8-1.1.mbs1.x86_64.rpm
07caaec38f12734fa485ec5ac58108f2 mbs1/x86_64/zarafa-client-7.1.8-1.1.mbs1.x86_64.rpm
8201924f8a2021a34bf74ccfd6ec576f mbs1/x86_64/zarafa-common-7.1.8-1.1.mbs1.x86_64.rpm
066260bb283e280e1d2674047816b30b mbs1/x86_64/zarafa-dagent-7.1.8-1.1.mbs1.x86_64.rpm
e583d4796a6d98723b4f18bca47744b3 mbs1/x86_64/zarafa-gateway-7.1.8-1.1.mbs1.x86_64.rpm
8b41c886437edce1eb583b91a43971f8 mbs1/x86_64/zarafa-ical-7.1.8-1.1.mbs1.x86_64.rpm
1347c9d77b5ea8a72ddc13cb94ddb3c1 mbs1/x86_64/zarafa-indexer-7.1.8-1.1.mbs1.x86_64.rpm
581ffb74503a3303782a10935ccc27e0 mbs1/x86_64/zarafa-monitor-7.1.8-1.1.mbs1.x86_64.rpm
ee7a4afd5c4d9a13bc63922555c507e7 mbs1/x86_64/zarafa-server-7.1.8-1.1.mbs1.x86_64.rpm
415c6fac59aff2dbfbe61087242d1aa6 mbs1/x86_64/zarafa-spooler-7.1.8-1.1.mbs1.x86_64.rpm
1c3d37d1beea23d73b84fd76bce47fdc mbs1/x86_64/zarafa-utils-7.1.8-1.1.mbs1.x86_64.rpm
d31a060121669abda9d720f4991094bf mbs1/x86_64/zarafa-webaccess-7.1.8-1.1.mbs1.noarch.rpm
00d2043f190032f6a624e0721d29242f mbs1/SRPMS/zarafa-7.1.8-1.1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUIs4hmqjQ0CJFipgRAvRCAJ4wDpxAVuBlFOSSzqskGMG6pKHOzACcDNzl
52oiDTAmeLxW4yTgFVIANrM=
=/D7b
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________