SquirrelMail decodeHeader HTML Injection Vulnerability

BID:11653

Info

SquirrelMail decodeHeader HTML Injection Vulnerability

Bugtraq ID: 11653
Class: Input Validation Error
CVE: CVE-2004-1036
Remote: Yes
Local: No
Published: Nov 10 2004 12:00AM
Updated: Jul 12 2009 08:06AM
Credit: Joost Pol disclosed this vulnerability to the vendor.
Vulnerable: SuSE Linux 8.1
SuSE Linux 8.0 i386
SuSE Linux 8.0
SquirrelMail SquirrelMail 1.5 Development Version
SquirrelMail SquirrelMail 1.4.8
SquirrelMail SquirrelMail 1.4.3 RC1
SquirrelMail SquirrelMail 1.4.3 a
+ Redhat Fedora Core3
 + Redhat Fedora Core3
 + Redhat Fedora Core3
 + Redhat Fedora Core2
 + Redhat Fedora Core2
 SquirrelMail SquirrelMail 1.4.3
SquirrelMail SquirrelMail 1.4.2
+ MandrakeSoft Corporate Server 3.0 x86_64
 + MandrakeSoft Corporate Server 3.0
+ MandrakeSoft Corporate Server 3.0
+ MandrakeSoft Corporate Server 3.0
+ Redhat Fedora Core2
 + Redhat Fedora Core2
 + Redhat Fedora Core2
 SquirrelMail SquirrelMail 1.4.1
SquirrelMail SquirrelMail 1.4
SquirrelMail SquirrelMail 1.2.11
SquirrelMail SquirrelMail 1.2.10
SquirrelMail SquirrelMail 1.2.9
SquirrelMail SquirrelMail 1.2.8
+ Terra Soft Solutions Yellow Dog Linux 3.0
SquirrelMail SquirrelMail 1.2.7
+ Redhat Linux 8.0
SquirrelMail SquirrelMail 1.2.6
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Debian Linux 3.0
SquirrelMail SquirrelMail 1.2.5
SquirrelMail SquirrelMail 1.2.4
SquirrelMail SquirrelMail 1.2.3
SquirrelMail SquirrelMail 1.2.2
SquirrelMail SquirrelMail 1.2.1
SquirrelMail SquirrelMail 1.2 .0
SquirrelMail SquirrelMail 1.0.5
SquirrelMail SquirrelMail 1.0.4
SGI ProPack 3.0
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 9.1
S.u.S.E. Linux Personal 9.0 x86_64
S.u.S.E. Linux Personal 9.0
S.u.S.E. Linux Personal 8.2
Gentoo Linux
Apple Mac OS X Server 10.3.7
Apple Mac OS X Server 10.3.6
Apple Mac OS X Server 10.3.5
Apple Mac OS X Server 10.3.4
Apple Mac OS X Server 10.3.3
Apple Mac OS X Server 10.3.2
Apple Mac OS X Server 10.3.1
Apple Mac OS X Server 10.3
Not Vulnerable:

Discussion

SquirrelMail decodeHeader HTML Injection Vulnerability

SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.

Exploit / POC

SquirrelMail decodeHeader HTML Injection Vulnerability

An exploit is not required.

Solution / Fix

SquirrelMail decodeHeader HTML Injection Vulnerability

Solution:
The vendor has released a patch to correct this issue in version 1.4.3a of SquirrelMail. The patch may also apply to previous versions, but this has not been confirmed. A fix has been applied to CVS versions as of 23 October 2004.

SuSE Linux has released a security summary report (SUSE-SR:2005:002) that contains fixes to address this and other vulnerabilities. Customers are advised to peruse the referenced advisory for further information regarding obtaining and applying appropriate updates.

Gentoo Linux has released advisory GLSA 200411-25 dealing with this issue. Gentoo advises that all SquirrelMail users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.3a-r2"

Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update. For more information please see the referenced Gentoo advisory.

Fedora has released advisories FEDORA-2004-471 and FEDORA-2004-472 for Fedora Core 2 and 3 respectively. Please see the attached advisories for details on obtaining and applying fixes.

Conectiva Linux has made advisory CLA-2004:905 available dealing with this issue. Please see the referenced advisory for more information.

SGI has released advisory 20050101-01-U to address various issues in SGI Advanced Linux Environment 3. This advisory includes updated SGI ProPack 3 Service Pack 3 packages. Please see the referenced advisory for more information.

Apple Computers has released advisory APPLE-SA-2005-01-25 along with a security update dealing with this and other issues. Please see the referenced advisory for more information.


SquirrelMail SquirrelMail 1.2.10

SquirrelMail SquirrelMail 1.2.7

SquirrelMail SquirrelMail 1.4.1

SquirrelMail SquirrelMail 1.4.2

SquirrelMail SquirrelMail 1.4.3 a

Apple Mac OS X Server 10.3.7

SGI ProPack 3.0

References

SquirrelMail decodeHeader HTML Injection Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report