BID:10246

SquirrelMail Folder Name Cross-Site Scripting Vulnerability

Info

SquirrelMail Folder Name Cross-Site Scripting Vulnerability

Bugtraq ID:	10246
Class:	Input Validation Error
CVE:	CVE-2004-0519
Remote:	Yes
Local:	No
Published:	Apr 30 2004 12:00AM
Updated:	Jul 12 2009 04:07AM
Credit:	Disclosure of this issue is credited to Alvin Alex <[email protected]>.
Vulnerable:	SquirrelMail SquirrelMail 1.4.2 + MandrakeSoft Corporate Server 3.0 x86_64 + MandrakeSoft Corporate Server 3.0 + MandrakeSoft Corporate Server 3.0 + MandrakeSoft Corporate Server 3.0 + Redhat Fedora Core2 + Redhat Fedora Core2 + Redhat Fedora Core2 SquirrelMail SquirrelMail 1.4.1 SquirrelMail SquirrelMail 1.4 SquirrelMail SquirrelMail 1.2.11 SquirrelMail SquirrelMail 1.2.10 SquirrelMail SquirrelMail 1.2.9 SquirrelMail SquirrelMail 1.2.8 + Terra Soft Solutions Yellow Dog Linux 3.0 SquirrelMail SquirrelMail 1.2.7 + Redhat Linux 8.0 SquirrelMail SquirrelMail 1.2.6 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 + Debian Linux 3.0 SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.2 .0 SquirrelMail SquirrelMail 1.0.5 SquirrelMail SquirrelMail 1.0.4 SGI ProPack 3.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 9.1 x86_64 S.u.S.E. Linux Professional 9.1 S.u.S.E. Linux Professional 9.0 x86_64 S.u.S.E. Linux Professional 9.0 Redhat Linux 9.0 i386

Not Vulnerable:	SquirrelMail SquirrelMail 1.4.8

Discussion

SquirrelMail Folder Name Cross-Site Scripting Vulnerability

It has been reported that SquirrelMail is affected by a cross-site scripting vulnerability in the handling of folder name displays. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

Exploit / POC

SquirrelMail Folder Name Cross-Site Scripting Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

http://www.example.com/mail/src/compose.php?mailbox=">&lt;script&gt;window.alert(document.cookie)&lt;/script&gt;

Solution / Fix

SquirrelMail Folder Name Cross-Site Scripting Vulnerability

Solution:
SquirrelMail 1.4.3 has been released to address this issue.

Gentoo has released an advisory (GLSA 200405-16) to address this issue. Please see the referenced advisory for more information. Gentoo users can carry out the following commands to upgrade their computers:
emerge sync
emerge -pv ">=net-mail/squirrelmail-1.4.3_rc1"
emerge ">=net-mail/squirrelmail-1.4.3_rc1"

Gentoo has released an advisory (GLSA 200405-16:02) to address errors in the previous Gentoo advisory. Please see the referenced advisory for more information.

RedHat has released an advisory (FEDORA-2004-160) to address this and other issues in Fedora Core 2. Please see the referenced advisory for more information.

RedHat has released an advisory (RHSA-2004:240-06) to address this and other issues in Red Hat Enterprise Linux. Please see the advisory in web references for more information.

SGI has released a security advisory (20040604-01-U) to address this and other issues in SGI ProPack 3. Please see the referenced advisory for more information.

Debian has released security advisory DSA 535-1 with fixes to address this issue.

Conectiva has released a security advisory (CLA-2004:858) to address multiple issues in SquirrelMail. Please see the referenced advisory for more information.

The Fedora Legacy project has released advisory FLSA:1733 along with fixes to address multiple issues in SquirrelMail for RedHat Linux 9. Please see the referenced advisory for further information.

SUSE has released a security summary report (SUSE-SR:2005:019) addressing this and other issues. Please see the referenced advisory for further information.

SquirrelMail SquirrelMail 1.0.4