SquirrelMail Unauthorized Source Code Modification Package Compromise Vulnerability

Bugtraq ID:	26879
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 13 2007 12:00AM
Updated:	Dec 14 2007 09:31PM
Credit:	The vendor reported this issue.
Vulnerable:	SquirrelMail SquirrelMail 1.4.12 SquirrelMail SquirrelMail 1.4.11
Not Vulnerable:	SquirrelMail SquirrelMail 1.4.15

SquirrelMail Unauthorized Source Code Modification Package Compromise Vulnerability

SquirrelMail is prone to a security vulnerability because the vendor's source code was compromised.

An attacker may be able to exploit this issue to execute arbitrary code within the context of the webserver process.

This issue affects SquirrelMail 1.4.11 and 1.4.12.

SquirrelMail Unauthorized Source Code Modification Package Compromise Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to install a compromised SquirrelMail package.

SquirrelMail Unauthorized Source Code Modification Package Compromise Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.


SquirrelMail SquirrelMail 1.4.11

• SquirrelMail squirrelmail-1.4.13.tar.gz
  http://www.squirrelmail.org/countdl.php?fileurl=http%3A%2F%2Fprdownloa ds.sourceforge.net%2Fsquirrelmail%2Fsquirrelmail-1.4.13.tar.gz

SquirrelMail SquirrelMail 1.4.12

• SquirrelMail squirrelmail-1.4.13.tar.gz
  http://www.squirrelmail.org/countdl.php?fileurl=http%3A%2F%2Fprdownloa ds.sourceforge.net%2Fsquirrelmail%2Fsquirrelmail-1.4.13.tar.gz

SquirrelMail Unauthorized Source Code Modification Package Compromise Vulnerability

References:

• SquirrelMail Homepage (SquirrelMail)
  
• SECURITY: 1.4.12 Package Compromise (SquirrelMail)