SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
BID:5949
Info
SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
| Bugtraq ID: | 5949 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-1132 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 11 2002 12:00AM |
| Updated: | Jul 11 2009 06:06PM |
| Credit: | This vulnerability was reported in a RedHat advisory. |
| Vulnerable: |
SquirrelMail SquirrelMail 1.2.7 SquirrelMail SquirrelMail 1.2.6 |
| Not Vulnerable: |
SquirrelMail SquirrelMail 1.2.8 |
Discussion
SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
A problem with SquirrelMail could make it possible for an attacker to gain sensitive information.
Under some conditions, SquirrelMail may reveal sensitive configuration information. When a malformed input is provided as arugments to the 'options.php' script,an error page will be generated. The error page returned contains absolute pathname of the options.php script.
A problem with SquirrelMail could make it possible for an attacker to gain sensitive information.
Under some conditions, SquirrelMail may reveal sensitive configuration information. When a malformed input is provided as arugments to the 'options.php' script,an error page will be generated. The error page returned contains absolute pathname of the options.php script.
Exploit / POC
SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
SquirrelMail Options.PHP Web Root Path Disclosure Vulnerability
Solution:
SquirrelMail 1.2.8 is not vulnerable to this issue. Users are advised to upgrade to the newest version of SquirrelMail.
SquirrelMail SquirrelMail 1.2.6
SquirrelMail SquirrelMail 1.2.7
Solution:
SquirrelMail 1.2.8 is not vulnerable to this issue. Users are advised to upgrade to the newest version of SquirrelMail.
SquirrelMail SquirrelMail 1.2.6
-
Debian squirrelmail_1.2.6-1.2_all.deb
http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelma il_1.2.6-1.2_all.deb
SquirrelMail SquirrelMail 1.2.7
-
RedHat squirrelmail-1.2.8-1.noarch.rpm
ftp://updates.redhat.com/8.0/en/os/noarch/squirrelmail-1.2.8-1.noarch. rpm -
SquirrelMail squirrelmail-1.2.8.tar.gz
http://prdownloads.sf.net/squirrelmail/squirrelmail-1.2.8.tar.gz