MasterMind Security Group, Inc. Security Brief Date: April 7, 2005 Contact: Gerald Quakenbush Severity: Moderate to Serious Product: Confirmed in eGroupWare 1.001 and 1.006 Synopsis ======== The eGroupWare open-source software (www.egroupware.org) has a flaw that could expose confidential information. The eGroupWare suite provides many applications via a web interface. One such application is for email. A flaw in this application could result in the unwitting disclosure of files. If a user composes a message and attaches a file, then decides not to send the message, the attachment will get sent to the next person the user emails. There is no indication in the message window that the file from the previous message is still attached, unless the user clicks on the button to attach a file to the second message. Mitigation ========== Until a patch is issued to resolve the problem, be aware of this issue. If you attach a file to a message and then decide not to send it, logout of eGroupWare then log back on before sending any new messages. Walk Through ============ Login to eGroupWare using an account that has email configured. Step 1. After logging in, select the email icon on the tool bar. Step 2. Click the Compose button to create a new message and attach a file. Do NOT click Send. Step 3. Without sending the message, return to the inbox. You can click the inbox link on the left of the email icon on the toolbar. Step 4. You are now back at the main inbox screen. Click on the Compose link again. Step 5. Enter an email address (a personal account or one of a trusted friend, preferably), a subject and brief message if you like and click Send. Step 6. Now check the email for the account you sent the message to above. The attachment from the canceled message in step 2 will be attached. -Quake -- ------------------------------------ Gerald Quakenbush, CISSP, NSA-IAM MasterMind Security Group, Inc. 888.295.6012 x701 http://www.mastermindsecuritygroup.com