SquirrelMail Email Header HTML Injection Vulnerability
BID:10439
Info
SquirrelMail Email Header HTML Injection Vulnerability
| Bugtraq ID: | 10439 |
| Class: | Input Validation Error |
| CVE: |
CVE-2004-0520 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2004 12:00AM |
| Updated: | Jul 12 2009 05:16AM |
| Credit: | Disclosure of this issue is credited to Roman Medina <[email protected]>. |
| Vulnerable: |
SquirrelMail SquirrelMail 1.5 Development Version SquirrelMail SquirrelMail 1.4.8 SquirrelMail SquirrelMail 1.4.3 RC1 SquirrelMail SquirrelMail 1.4.2 SquirrelMail SquirrelMail 1.4.1 SquirrelMail SquirrelMail 1.4 SquirrelMail SquirrelMail 1.2.11 SquirrelMail SquirrelMail 1.2.10 SquirrelMail SquirrelMail 1.2.9 SquirrelMail SquirrelMail 1.2.8 SquirrelMail SquirrelMail 1.2.7 SquirrelMail SquirrelMail 1.2.6 SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.2 .0 SGI ProPack 3.0 Redhat Linux 9.0 i386 Open Webmail Open Webmail 2.32 Open Webmail Open Webmail 2.31 Open Webmail Open Webmail 2.30 |
| Not Vulnerable: |
SquirrelMail SquirrelMail 1.4.8 SquirrelMail SquirrelMail 1.4.3 RC1 |
Discussion
SquirrelMail Email Header HTML Injection Vulnerability
SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.
An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.
SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.
An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.
Exploit / POC
SquirrelMail Email Header HTML Injection Vulnerability
No exploit is required to leverage this issue. Successful exploitation is reported to depend on the IMAP server used to parse the offending email. The following proof of concept value of 'Content-Type' has been provided:
Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf
No exploit is required to leverage this issue. Successful exploitation is reported to depend on the IMAP server used to parse the offending email. The following proof of concept value of 'Content-Type' has been provided:
Content-Type: application/octet-stream"<script>window.alert(document.cookie)</script>"; name=top_secret.pdf
Solution / Fix
SquirrelMail Email Header HTML Injection Vulnerability
Solution:
The vendor has released an upgrade dealing with this issue.
This issue has been fixed in the current stable version of Open WebMail.
RedHat has released an advisory (FEDORA-2004-160) to address this and other issues in Fedora Core 2. Please see the referenced advisory for more information.
RedHat has released an advisory (RHSA-2004:240-06) to address this and other issues in Red Hat Enterprise Linux. Please see the advisory in web references for more information.
Gentoo has released a security advisory (GLSA 200406-08) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
emerge sync
emerge -pv ">=mail-client/squirrelmail-1.4.3"
emerge ">=mail-client/squirrelmail-1.4.3"
SGI has released a security advisory (20040604-01-U) to address this and other issues in SGI ProPack 3. Please see the referenced advisory for more information.
Debian has released security advisory DSA 535-1 with fixes to address this issue.
Conectiva has released a security advisory (CLA-2004:858) to address multiple issues in squirrelmail. Please see the referenced advisory for more information.
The Fedora Legacy project has released advisory FLSA:1733 along with fixes to address multiple issues in SquirrelMail for RedHat Linux 9. Please see the referenced advisory for further information.
SquirrelMail SquirrelMail 1.2 .0
SquirrelMail SquirrelMail 1.2.1
SquirrelMail SquirrelMail 1.2.2
SquirrelMail SquirrelMail 1.2.3
SquirrelMail SquirrelMail 1.2.4
SquirrelMail SquirrelMail 1.2.5
SquirrelMail SquirrelMail 1.2.6
SquirrelMail SquirrelMail 1.4
SquirrelMail SquirrelMail 1.4.1
SquirrelMail SquirrelMail 1.4.2
SquirrelMail SquirrelMail 1.4.8
Open Webmail Open Webmail 2.30
Open Webmail Open Webmail 2.31
Open Webmail Open Webmail 2.32
SGI ProPack 3.0
Solution:
The vendor has released an upgrade dealing with this issue.
This issue has been fixed in the current stable version of Open WebMail.
RedHat has released an advisory (FEDORA-2004-160) to address this and other issues in Fedora Core 2. Please see the referenced advisory for more information.
RedHat has released an advisory (RHSA-2004:240-06) to address this and other issues in Red Hat Enterprise Linux. Please see the advisory in web references for more information.
Gentoo has released a security advisory (GLSA 200406-08) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:
emerge sync
emerge -pv ">=mail-client/squirrelmail-1.4.3"
emerge ">=mail-client/squirrelmail-1.4.3"
SGI has released a security advisory (20040604-01-U) to address this and other issues in SGI ProPack 3. Please see the referenced advisory for more information.
Debian has released security advisory DSA 535-1 with fixes to address this issue.
Conectiva has released a security advisory (CLA-2004:858) to address multiple issues in squirrelmail. Please see the referenced advisory for more information.
The Fedora Legacy project has released advisory FLSA:1733 along with fixes to address multiple issues in SquirrelMail for RedHat Linux 9. Please see the referenced advisory for further information.
SquirrelMail SquirrelMail 1.2 .0
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.1
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.2
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.3
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.4
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.5
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.6
-
Conectiva squirrelmail-1.4.3a-13677U90_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squirrelmail-1.4.3a-13677U9 0_1cl.noarch.rpm -
Conectiva squirrelmail-doc-1.4.3a-13677U90_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squirrelmail-doc-1.4.3a-136 77U90_1cl.noarch.rpm -
Debian squirrelmail_1.2.6-1.4_all.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelma il_1.2.6-1.4_all.deb -
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.1
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.2
-
SquirrelMail squirrelmail-1.4.3.tar.gz
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.8
-
RedHat squirrelmail-1.4.3-0.f0.9.1.legacy.noarch.rpm
RedHat Linux 9
http://download.fedoralegacy.org/redhat/9/updates/i386/i386/squirrelma il-1.4.3-0.f0.9.1.legacy.noarch.rpm
Open Webmail Open Webmail 2.30
-
Open WebMail Open WebMail Current
http://openwebmail.org/openwebmail/download/
Open Webmail Open Webmail 2.31
-
Open WebMail Open WebMail Current
http://openwebmail.org/openwebmail/download/
Open Webmail Open Webmail 2.32
-
Open WebMail Open WebMail Current
http://openwebmail.org/openwebmail/download/
SGI ProPack 3.0
-
SGI patch10083.tar.gz
ftp://patches.sgi.com/support/free/security/patches/ProPack/3/patch100 83.tar.gz
References
SquirrelMail Email Header HTML Injection Vulnerability
References:
References:
- Product Changelog (Open WebMail)
- RHSA-2004:240-06 - SquirrelMail (RedHat)
- XMB Homepage (XMB)
- [Full-Disclosure] RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability (Roman Medina