SquirrelMail Multiple Remote Input Validation Vulnerabilities
BID:12337
Info
SquirrelMail Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 12337 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-0104 CVE-2005-0103 CVE-2005-0075 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 22 2005 12:00AM |
| Updated: | Jul 12 2009 10:06AM |
| Credit: | Manoel Zaninetti is credited with the discovery of the frame content manipulation issue. Jimmy Conner is credited with discovering the local file inclusion issue. The cross-site scripting issue was reported by the vendor. |
| Vulnerable: |
SuSE Linux Enterprise Server 9 SquirrelMail SquirrelMail 1.4.8 SquirrelMail SquirrelMail 1.4.4 RC1 SquirrelMail SquirrelMail 1.4.3 RC1 SquirrelMail SquirrelMail 1.4.3 r3 SquirrelMail SquirrelMail 1.4.3 a SquirrelMail SquirrelMail 1.4.3 SquirrelMail SquirrelMail 1.4.2 SquirrelMail SquirrelMail 1.4.1 SquirrelMail SquirrelMail 1.4 RC1 SquirrelMail SquirrelMail 1.4 SquirrelMail SquirrelMail 1.2.11 SquirrelMail SquirrelMail 1.2.10 SquirrelMail SquirrelMail 1.2.9 SquirrelMail SquirrelMail 1.2.8 SquirrelMail SquirrelMail 1.2.7 SquirrelMail SquirrelMail 1.2.6 SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.2 .0 SGI ProPack 3.0 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 9.1 x86_64 S.u.S.E. Linux Personal 9.1 S.u.S.E. Linux Personal 9.0 x86_64 S.u.S.E. Linux Personal 9.0 S.u.S.E. Linux Enterprise Server for S/390 9.0 Redhat Fedora Core3 Redhat Fedora Core2 |
| Not Vulnerable: |
SquirrelMail SquirrelMail 1.4.4 |
Discussion
SquirrelMail Multiple Remote Input Validation Vulnerabilities
SquirrelMail is reported prone to multiple vulnerabilities resulting from input validation errors. These issues may allow an attacker to carry out cross-site scripting and file include attacks. An attacker may also include arbitrary web pages in the SquirrelMail frameset to carry out phishing type attacks.
The following specific issues were identified:
SquirrelMail is reported prone to a cross-site scripting vulnerability. Attacker-supplied code may be rendered in a user's browser facilitating theft of cookie-based authentication credentials and other attacks.
It is reported that an attacker may influence Web content through certain unspecified variables. It is conjectured that this may allow attackers to misrepresent Web content and potentially carry out phishing type attacks.
The application is reported prone to a file include vulnerability as well. Reportedly, an affected script can allow remote attackers to include local scripts. This may eventually lead to unauthorized access in the context of the affected server.
SquirrelMail is reported prone to multiple vulnerabilities resulting from input validation errors. These issues may allow an attacker to carry out cross-site scripting and file include attacks. An attacker may also include arbitrary web pages in the SquirrelMail frameset to carry out phishing type attacks.
The following specific issues were identified:
SquirrelMail is reported prone to a cross-site scripting vulnerability. Attacker-supplied code may be rendered in a user's browser facilitating theft of cookie-based authentication credentials and other attacks.
It is reported that an attacker may influence Web content through certain unspecified variables. It is conjectured that this may allow attackers to misrepresent Web content and potentially carry out phishing type attacks.
The application is reported prone to a file include vulnerability as well. Reportedly, an affected script can allow remote attackers to include local scripts. This may eventually lead to unauthorized access in the context of the affected server.
Exploit / POC
SquirrelMail Multiple Remote Input Validation Vulnerabilities
An exploit is not required to carry out these attacks.
An exploit is not required to carry out these attacks.
Solution / Fix
SquirrelMail Multiple Remote Input Validation Vulnerabilities
Solution:
The vendor has released SquirrelMail 1.4.4 to address this issue. Patches for affected versions are available as well.
RedHat has released advisories (FEDORA-2005-259), and (FEDORA-2005-260) to address these issues in Fedora Core 2 and 3. Please see the referenced advisories for further information.
Gentoo Linux has released advisory GLSA 200501-39 dealing with this issue. Gentoo advises that all SquirrelMail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.4"
Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update. For more information, please see the referenced Gentoo Linux advisory.
Debian has released advisory DSA 662-1 along with fixes dealing with these issues. Please see the referenced advisory for more information.
SGI has released advisory 20050207-01-U including Patch 10144 that contains updated SGI ProPack 3 Service Pack 4 RPMs for the SGI Altix products. This patch addresses various issues. Please see the referenced advisory for more information.
Debian has released advisory DSA 662-2 to address the issue described in CAN-2005-0104. Please see the referenced advisory for more information.
SUSE Linux has released advisory SUSE-SR:2005:014 to address these and other issues. Please see the referenced advisory for more information.
SquirrelMail SquirrelMail 1.2.6
SquirrelMail SquirrelMail 1.4 RC1
SquirrelMail SquirrelMail 1.4
SquirrelMail SquirrelMail 1.4.1
SquirrelMail SquirrelMail 1.4.2
SquirrelMail SquirrelMail 1.4.3 RC1
SquirrelMail SquirrelMail 1.4.3 a
SquirrelMail SquirrelMail 1.4.3 r3
SquirrelMail SquirrelMail 1.4.3
SquirrelMail SquirrelMail 1.4.4 RC1
SquirrelMail SquirrelMail 1.4.8
SGI ProPack 3.0
Solution:
The vendor has released SquirrelMail 1.4.4 to address this issue. Patches for affected versions are available as well.
RedHat has released advisories (FEDORA-2005-259), and (FEDORA-2005-260) to address these issues in Fedora Core 2 and 3. Please see the referenced advisories for further information.
Gentoo Linux has released advisory GLSA 200501-39 dealing with this issue. Gentoo advises that all SquirrelMail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.4"
Note: Users with the vhosts USE flag set should manually use webapp-config to finalize the update. For more information, please see the referenced Gentoo Linux advisory.
Debian has released advisory DSA 662-1 along with fixes dealing with these issues. Please see the referenced advisory for more information.
SGI has released advisory 20050207-01-U including Patch 10144 that contains updated SGI ProPack 3 Service Pack 4 RPMs for the SGI Altix products. This patch addresses various issues. Please see the referenced advisory for more information.
Debian has released advisory DSA 662-2 to address the issue described in CAN-2005-0104. Please see the referenced advisory for more information.
SUSE Linux has released advisory SUSE-SR:2005:014 to address these and other issues. Please see the referenced advisory for more information.
SquirrelMail SquirrelMail 1.2.6
-
Debian squirrelmail_1.2.6-2_all.deb
http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelma il_1.2.6-2_all.deb -
Debian squirrelmail_1.2.6-3_all.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelma il_1.2.6-3_all.deb
SquirrelMail SquirrelMail 1.4 RC1
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.1
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.2
-
Fedora squirrelmail-1.4.4-1.FC2.noarch.rpm
RedHat Fedora Core 2
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/ -
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.3 RC1
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.3 a
-
Fedora squirrelmail-1.4.4-1.FC3.noarch.rpm
RedHat Fedora Core 3
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/ -
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.3 r3
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.3
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.4 RC1
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.4.8
-
SquirrelMail SquirrelMail 1.4.4
http://www.squirrelmail.org/download.php
SGI ProPack 3.0
-
SGI Patch10144
http://support.sgi.com/
References
SquirrelMail Multiple Remote Input Validation Vulnerabilities
References:
References:
- Frame content changing in webmail.php (SquirrelMail)
- Local file inclusions in prefs.php (SquirrelMail)
- XMB Homepage (XMB)
- XSS vulnerability in webmail.php (SquirrelMail)
- SquirrelMail Security Advisory (Jonathan Angliss