eGroupWare: Enterprise Collaboration

eGroupWare is a web-based and multi-user groupware suite developed on a custom set of PHP-based APIs.

Features:

• email
• addressbook
• calendar
• infolog (notes, to-do's, phone calls)
• content management
• forum
• bookmarks
• wiki

What is new in this release:

• The new release fixes 2 serious security problems, many bugs and implements SyncML 1.2
• Nahuel Grisolia from CYBSEC S.A. Security Systems found two security problems in EGroupware...
• one is a serious remote command execution (allowing to run arbitrary command on the web server by simply issuing a HTTP request!).
• the other a reflected cross-site scripting (XSS).
• both require NO valid EGroupware account and work without being logged in!
• Vulnerable are all EGroupware version incl. 1.4.001+.002, 1.6.001+.002 and the commercial EPL versions 9.1+9.2!
• The problem is fixed in EGroupware's SVN (for 1.6 and trunk) and there will be a coordinated release of a new EGroupware version 1.6.003 by
• Stylite GmbH / EGroupware project and publication of the exploits by CYBSEC S.A. on March 9th.
• WE RECOMMEND EVERYONE UPDATES AS SOON AS POSSIBLE!

What is new in version 1.6.002:

• fixes 3 security problems:
• FCKeditor (remote file upload)
• tracker (XSS problem)
• knowledgebase (SQL injection)
• added HTML Purifier as preventive measure for FCKeditor content
• tons of bugfixes since initial 1.6.001 release

What is new in version 1.6:

• A complete rewrite of file manager DMS by means of streamwrapper and WebDAV.
• ACL control on directories and files, which allows uploads of big files.
• Multiple mail accounts and many bugfixes.
• Tracker has an escalation matrix for tickets and automatic mail conversion.
• Calendar has improved functions for recurring events.
• Addressbook has appointment-view, custom fields, and distribution lists shown in contact view and list.
• The project manager has improved template functionality.
• A new default theme for 1.6.
• Massive bugfixes for SyncML.
• Many useful extensions and bugfixes in all modules.

What is new in version 1.6 RC3:

• Complete new implementation of the filemanager DMS by means of streamwrapper and WebDAV, ACL control on directories and files - the new architecture allows now uploading of big files.
• Implementation of new functions like multiple mail accounts and many bug-fixes in the email client.
• Extensive new features for the tracker-application: for example escalation-matrix for tickets and automatic mail-conversion as a ticket.
• Improved calendar functions especially with recurring-events.
• Supplements and adaptations in the addressbook like appointment-view, custom fields, distribution lists shown in the contact directly and in the addressbook list, multiple categorization of contacts in the addressbook list.
• Improvement of the template functionality of the project manager and some bug-fixes.
• Many useful extensions and adaptations as well as bug-fixes in all modules.