CVE-2019-19907

What it actually does

Out-of-bounds memory access during ICal data parsing in the freebusy utility, enabling memory corruption that can lead to arbitrary code execution or denial of service.

Why it matters to the business

Attackers can remotely compromise groupware servers handling calendar data, resulting in data theft, service disruption, or full system takeover; the vulnerability affects organizations relying on Kopano for collaboration tools and has remained unpatched in many deployments for years.

How an attack unfolds

An attacker crafts a malicious ICal payload that triggers improper array handling in HrAddFBBlock, sends it to the Kopano server via network-accessible ICal import or freebusy queries, and leverages the resulting out-of-bounds access for code execution.

How to fix it

Upgrade Kopano Groupware Core to version 8.7.7 or later; disable ICal parsing features if immediate upgrade is impossible; monitor vendor advisories for any subsequent backports.

How to confirm the fix worked

Verify installed version is 8.7.7 or higher; test ICal import functionality with known-malformed calendar data in a lab environment; review changelog entries referencing freebusyutil.cpp fixes.

Typical attack path

1. Identify reachable Kopano Groupware Core instance accepting ICal data
2. Craft ICal input that causes mishandled array copy in freebusyutil.cpp
3. Deliver payload through email, calendar import, or freebusy request
4. Trigger parsing to achieve out-of-bounds memory access
5. Escalate to remote code execution or crash the service

How to detect it

Review application and web server logs for ICal parsing errors or crashes in freebusyutil; look for unusual freebusy query volumes or malformed calendar attachments; examine process crash dumps for memory access violations during ICal handling.

What your security team should do

• Prioritize upgrade of all Kopano Groupware Core instances to 8.7.7+
• Restrict network exposure of ICal endpoints to trusted sources only
• Implement input validation or WAF rules blocking suspicious ICal structures
• Scan historical logs for ICal parsing anomalies around freebusy operations