CVE-2009-1381

Summary

CVE	CVE-2009-1381
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2009-05-22 20:30:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

Primary CVSS: v2.0 6.8 from [email protected]

AV:N/AC:M/Au:N/C:P/I:P/A:P

Problem Types: NVD-CWE-Other | n/a

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

Type	Vendor	Product	Version	Update	Edition	Language
Application	Squirrelmail	Imap General.php	1.2.2	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2-r1	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2-r2	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2-r3	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2-r4	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.2-r5	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.3_rc1	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.3_rc1	r1	All	All
Application	Squirrelmail	Squirrelmail	1.2.10	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.11	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.5	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.6	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.6-rc1	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.7	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.8	All	All	All
Application	Squirrelmail	Squirrelmail	1.2.9	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.0	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.0-r1	All	All	All
Application	Squirrelmail	Squirrelmail	1.4.1	All	All	All
Application	Squirrelmail	Squirrelmail1.4.19-1	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
[SECURITY] Fedora 10 Update: squirrelmail-1.4.19-1.fc10	af854a3a-2127-422b-91ae-364da2661108	www.redhat.com
Debian update for squirrelmail - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
Debian -- Security Information -- DSA-1802-2 squirrelmail	af854a3a-2127-422b-91ae-364da2661108	www.debian.org	Vendor Advisory
404 Not Found	af854a3a-2127-422b-91ae-364da2661108	release.debian.org	Exploit, Vendor Advisory
Support / Security / Advisories / / MDVSA-2009:122 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com
SecurityFocus	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
[SECURITY] Fedora 9 Update: squirrelmail-1.4.19-1.fc9	af854a3a-2127-422b-91ae-364da2661108	www.redhat.com
CVE-2009-1381 - Red Hat Customer Portal	MITRE	access.redhat.com
502137 – (CVE-2009-1381) CVE-2009-1381 squirrelmail: incomplete fix for CVE-2009-1579	MITRE	bugzilla.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2009-05-26	Tomas Hoger	Not vulnerable. This issue did not affect the versions of squirrelmail as shipped with Red Hat Enterprise Linux 3, 4, or 5. Updates for squirrelmail released via RHSA-2009:1066 (https://rhn.redhat.com/errata/RHSA-2009-1066.html) fixed original flaw CVE-2009-1579 without introducing CVE-2009-1381.

There are currently no legacy QID mappings associated with this CVE.