roundcube security bug

Brent Clark brentgclarklist at
Mon Mar 9 00:43:28 PDT 2009

Zbigniew Szalbot wrote:
> hello,
> I strongly advise anyone who has the mail/roundcube port or software
> installed to be careful as it has a security bug (and I do not know
> where to report it). It allows people to remotely place a trojan on
> /tmp and use it. They do it like this:
> - - [05/Mar/2009:19:22:14 +0100] "POST
> /roundcube/bin/html2text.php HTTP/1.0" 406
> and as a result a non-empty directory /tmp/guestbook.ntr/ is created
> and a file /tmp/guestbook.php
> This html2text.php file has been used by an attacker on my system (at
> least I think so). I have removed the port and since then I have had
> no trouble, although they have been scanning for this file as I can
> read in the logs.
> Yours,

Have you notified and / or checked with the upstream authour (maybe the 
mailinglist too).

Brent Clark

More information about the freebsd-questions mailing list