Disable DNS prefetching to avoid information leakage through links

embedded in messages. This fixes CVE-2010-0464. Closes: #569660.

diff --git a/debian/changelog b/debian/changelog
index da17bc5d67a9d72a50ab80b76d3ba0840fd5bb80..6323ebdc931475f1871688c10ce4ec4f5c81d3e8 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,12 @@
-roundcube (0.3.1-3) UNRELEASED; urgency=low
+roundcube (0.3.1-3) UNRELEASED; urgency=high
 
   * RFC 5321, section 4.5.3.1, asks to not impose any limits on length if
     possible. We respect this by dropping limitation of the local-part of
     an email address. Closes: #568360, #568537.
   * Suggests php-auth-sasl to enable use of SASL mechanisms for mail
     servers. Closes: #567550.
+  * Disable DNS prefetching to avoid information leakage through links
+    embedded in messages. This fixes CVE-2010-0464. Closes: #569660.
 
  -- Vincent Bernat <bernat@debian.org>  Fri, 05 Feb 2010 19:50:51 +0100
 

diff --git a/debian/patches/disable-dns-prefetch.patch b/debian/patches/disable-dns-prefetch.patch
new file mode 100644 (file)
index 0000000..450145f
--- /dev/null
+++ b/debian/patches/disable-dns-prefetch.patch
@@ -0,0 +1,20 @@
+Disable DNS prefetching to solve CVE-2010-0464.
+
+Index: program/include/rcube_html_page.php
+===================================================================
+--- rcube/program/include/rcube_html_page.php  (revision 3214)
++++ rcube/program/include/rcube_html_page.php  (working copy)
+@@ -165,6 +165,13 @@
+             $__page_header.= $this->charset . '" />'."\n";
+         }
+ 
++        // add hint to disable DNS prefetching
++        if (!headers_sent()) {
++            header('X-DNS-Prefetch-Control: off');
++        } else {
++            $__page_header.= '<meta http-equiv="x-dns-prefetch-control" content="off" />'."\n";
++        }
++
+         // definition of the code to be placed in the document header and footer
+         if (is_array($this->script_files['head'])) {
+             foreach ($this->script_files['head'] as $file) {

diff --git a/debian/patches/series b/debian/patches/series
index a8f436fe6d6d902201227fc61cfdcfab350e95ab..b76ac529f3ff582f07ab1ddb5bdbac1d607b308c 100644 (file)
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@ loginbox-size.patch
 changeset_r3170.patch
 changeset_r3202.patch
 dont-limit-email-local-part.patch
+disable-dns-prefetch.patch