SquirrelMail HTML Attachment Script Injection Vulnerability
BID:4666
Info
SquirrelMail HTML Attachment Script Injection Vulnerability
| Bugtraq ID: | 4666 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2002 12:00AM |
| Updated: | Apr 09 2002 12:00AM |
| Credit: | Discovery of this issue is credited to Nick Cleaton. |
| Vulnerable: |
SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.2 .0 |
| Not Vulnerable: |
SquirrelMail SquirrelMail 1.2.6 |
Discussion
SquirrelMail HTML Attachment Script Injection Vulnerability
SquirrelMail is a webmail program implemented in PHP. It is available for Linux and Unix based operating systems.
SquirrelMail does not adequately filter script code from the body of webmail HTML file attachments. This may enable a remote attacker to cause script code to be executed in the browser of a webmail user who opens the attachment.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the webmail system.
SquirrelMail is a webmail program implemented in PHP. It is available for Linux and Unix based operating systems.
SquirrelMail does not adequately filter script code from the body of webmail HTML file attachments. This may enable a remote attacker to cause script code to be executed in the browser of a webmail user who opens the attachment.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the webmail system.
Solution / Fix
SquirrelMail HTML Attachment Script Injection Vulnerability
Solution:
This issue has been addressed in version 1.2.6 of SquirrelMail. Users are advised to upgrade.
SquirrelMail SquirrelMail 1.2 .0
SquirrelMail SquirrelMail 1.2.1
SquirrelMail SquirrelMail 1.2.2
SquirrelMail SquirrelMail 1.2.3
SquirrelMail SquirrelMail 1.2.4
SquirrelMail SquirrelMail 1.2.5
Solution:
This issue has been addressed in version 1.2.6 of SquirrelMail. Users are advised to upgrade.
SquirrelMail SquirrelMail 1.2 .0
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.1
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.2
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.3
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.4
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.5
-
SquirrelMail squirrelmail-1.2.6
http://www.squirrelmail.org/download.php
References
SquirrelMail HTML Attachment Script Injection Vulnerability
References:
References:
- Re: SquirrelMail 1.2.5 security: HTML filter flaw (squirrelmail-devel )
- XMB Homepage (XMB)