RoundCube Webmail remote email relay Vulnerability

Release date:
Updated on:

Affected Systems:
RoundCube Webmail 0.3.1
RoundCube Webmail 0.2.2
MandrakeSoft Enterprise Server 5 x86_64
Unaffected system:
RoundCube Webmail 0.5.1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 47247
Cve id: CVE-2011-1492

RoundCube Webmail is a browser-based IMAP client.

In versions earlier than RoundCube Webmail 0.5.1, the email relay vulnerability exists. Attackers can exploit this vulnerability to bypass certain security restrictions and send relay emails.

<* Source: vendor
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

RoundCube
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://roundcube.net/