Security updates 1.3.3, 1.2.7 and 1.1.10 released

News and Announcements > News & Announcements

(1/7) > >>

SKaero:
We just published updates to all stable versions from 1.1.x onwards delivering fixes for a recently discovered file disclosure vulnerability in Roundcube Webmail.

Apparently this zero-day exploit is already being used by hackers to read Roundcube’s configuration files. It requires a valid username/password as the exploit only works with a valid session. More details will be published soon under CVE-2017-16651.

The Roundcube series 1.0.x is not affected by this vulnerability but we nevertheless back-ported the fix in order to protect from yet unknown exploits.

See the full changelog for the according version in the release notes on the Github download pages: v1.3.3, v1.2.7, v1.1.10 v1.0.12

We strongly recommend to update all productive installations of Roundcube with either one of these versions.

Mitigation
In order to check whether your Roundcube installation has been compromised check the access logs for requests like ?_task=settings&_action=upload-display&_from=timezone. As mentioned above, the file disclosure only works for authenticated users and by finding such requests in the logs you should also be able to identify the account used for this unauthorized access. For mitigation we recommend to change the all credentials to external services like database or LDAP address books and preferably also the des_key option in your config.

Source: https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
Get it Now: https://roundcube.net/download

ElasticUser:
I installed 1.2.7 from GitHub, and It's not logging in and sending messages properly. It goes very slow, and hardly ever logs in. A server tech has no clue what's causing that. Any ideas? :--)

SKaero:
Whats in your error log?

ElasticUser:
[30-Nov-2017 07:30:23 +0000]: <v6vg3979> Session auth check failed for v6vg3979g16nu9i2h4tfkbvga4; timeslot = 2017-11-30 07:30:00
[30-Nov-2017 07:30:23 +0000]: <v6vg3979> Session authentication failed for v6vg3979g16nu9i2h4tfkbvga4; invalid auth cookie sent; timeslot = 2017-11-30 07:20:00
[30-Nov-2017 07:39:44 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 07:35:00
[30-Nov-2017 07:39:44 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512027000
[30-Nov-2017 07:40:46 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 07:40:00
[30-Nov-2017 07:40:46 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512027300
[30-Nov-2017 07:45:51 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 07:45:00
[30-Nov-2017 07:45:51 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512027600
[30-Nov-2017 07:50:16 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 07:50:00
[30-Nov-2017 07:50:16 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512027900
[30-Nov-2017 07:55:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 07:55:00
[30-Nov-2017 07:55:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512028200
[30-Nov-2017 08:00:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:00:00
[30-Nov-2017 08:00:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512028500
[30-Nov-2017 08:05:22 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:05:00
[30-Nov-2017 08:05:22 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512028800
[30-Nov-2017 08:10:00 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:10:00
[30-Nov-2017 08:10:00 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512029100
[30-Nov-2017 08:17:00 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:15:00
[30-Nov-2017 08:17:00 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512029400
[30-Nov-2017 08:20:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:20:00
[30-Nov-2017 08:20:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512029700
[30-Nov-2017 08:25:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:25:00
[30-Nov-2017 08:25:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512030000
[30-Nov-2017 08:30:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:30:00
[30-Nov-2017 08:30:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512030300
[30-Nov-2017 08:35:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:35:00
[30-Nov-2017 08:35:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512030600
[30-Nov-2017 08:40:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:40:00
[30-Nov-2017 08:40:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512030900
[30-Nov-2017 08:45:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:45:00
[30-Nov-2017 08:45:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512031200
[30-Nov-2017 08:50:20 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:50:00
[30-Nov-2017 08:50:20 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512031500
[30-Nov-2017 08:55:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 08:55:00
[30-Nov-2017 08:55:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512031800
[30-Nov-2017 09:00:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:00:00
[30-Nov-2017 09:00:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512032100
[30-Nov-2017 09:05:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:05:00
[30-Nov-2017 09:05:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512032400
[30-Nov-2017 09:10:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:10:00
[30-Nov-2017 09:10:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512032700
[30-Nov-2017 09:15:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:15:00
[30-Nov-2017 09:15:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512033000
[30-Nov-2017 09:20:19 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:20:00
[30-Nov-2017 09:20:19 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512033300
[30-Nov-2017 09:25:18 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 09:25:00
[30-Nov-2017 09:25:18 +0000]: <r7u9fnmo> Send new auth cookie for r7u9fnmoek1kmuus9qitj7lgp1: bIPIylwpkN07xlV8XAFQ426vjB-1512033600
[30-Nov-2017 15:43:14 +0000]: <r7u9fnmo> Session auth check failed for r7u9fnmoek1kmuus9qitj7lgp1; timeslot = 2017-11-30 15:40:00
[30-Nov-2017 15:43:14 +0000]: <r7u9fnmo> Session authentication failed for r7u9fnmoek1kmuus9qitj7lgp1; invalid auth cookie sent; timeslot = 2017-11-30 15:30:00

SKaero:
So are you able to login or is it hanging at the login page?

Navigation

[0] Message Index

[#] Next page

Go to full version