###############################################################################
#
#  Copyright: OS2A and it's member companies
#
#  $Revision: 1.1 $
#
#  $Log: os2a_DSA-1034-1_800415.nasl,v $
#  Revision 1.1  2006/04/15 04:56:20  hpavithra
#  Debian Advisory
#
#
#  ------------------------------------------------------------------------
#  This program was written by OS2A and/or it's member companies and is
#  licensed under the GNU GPL license. Please see below for details. This
#  header contains information regarding licensing terms under the GPL, and
#  information regarding obtaining source code from the Author. Consequently,
#  pursuant to section 3(c) of the GPL, you must accompany the information
#  found in this header with any distribution you make of this Program.
#  ------------------------------------------------------------------------
##############################################################################

# The plugin text is copyright Debian, Inc.

if(!defined_func("bn_random")) exit(0);
if(description)
{
 script_id(800415);
 script_cve_id("CVE-2006-1260,CVE-2006-1491");
 script_version ("$Revision: 1.1 $");
 name["english"] = "Debian update for horde2: DSA-1034-1";
 script_name(english:name["english"]);
 desc["english"] = "
 Overview and Solution :
 Several remote vulnerabilities have been discovered in the Horde web
 application framework, which may lead to the execution of arbitrary
 web script code. The Common Vulnerabilities and Exposures project
 identifies the following problems:
 Null characters in the URL parameter bypass a sanity check, which
 allowed remote attackers to read arbitrary files, which allowed
 information disclosure.
 User input in the help viewer was passed unsanitised to the eval()
 function, which allowed injection of arbitrary web code.
 The old stable distribution (woody) doesn't contain horde2 packages.
 For the stable distribution (sarge) these problems have been fixed in
 version 2.2.8-1sarge2.
 The unstable distribution (sid) does no longer contain horde2 packages.
 We recommend that you upgrade your horde2 package.

 Affected Platforms :
 Debian 3.1

 References :
 http://www.debian.org/security/2006/dsa-1034

 Risk factor : High";
 script_description(english:desc["english"]);
 summary["english"] = "Check for the version of horde2 package";
 script_summary(english:summary["english"]);
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"Copyright (C) 2006 OS2A");
 family["english"] = "Debian Local Security Checks";
 script_family(english:family["english"]);
 script_dependencies("ssh_get_info.nasl");
 script_require_keys("Host/Debian/dpkg-l", "Host/Debian/release");
 exit(0);
}


include("debian_package.inc");

release = get_kb_item("Host/Debian/release");
if(release == NULL){
    exit(0);
}

if(release == "3.1")
{
    
 if(deb_check(prefix:"horde2", release:"3.1", reference:"2.2.8-1sarge2"))
 {
  security_hole(0);
  exit(0);
 }
    
 if(deb_pkg_exists(prefix:"horde2", release:"3.1"))
 {
  set_kb_item(name:"DSA-1034-1", value:TRUE);
  exit(0);
 }
    
}