SquirrelMail global.php Cross Site Scripting Vulnerability

Bugtraq ID:	7019
Class:	Input Validation Error
CVE:	CVE-2002-1276
Remote:	Yes
Local:	No
Published:	Nov 11 2002 12:00AM
Updated:	Jul 11 2009 08:06PM
Credit:	This vulnerability was reported in a Debian advisory.
Vulnerable:	SquirrelMail SquirrelMail 1.2.8 + Terra Soft Solutions Yellow Dog Linux 3.0 SquirrelMail SquirrelMail 1.2.7 + Redhat Linux 8.0 SquirrelMail SquirrelMail 1.2.6 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 alpha + Debian Linux 3.0 + Debian Linux 3.0
Not Vulnerable:

SquirrelMail global.php Cross Site Scripting Vulnerability

A cross-site scripting vulnerability has been discovered in SquirrelMail. The global.php script fails to adequately sanitize content passed to the strip_tags() function.

This may allow for theft of cookie-based authentication credentials and other attacks.

SquirrelMail global.php Cross Site Scripting Vulnerability

Solution:
The following fixes are available:


SquirrelMail SquirrelMail 1.2.6

• Debian squirrelmail_1.2.6-1.3_all.deb
  http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelma il_1.2.6-1.3_all.deb

SquirrelMail SquirrelMail 1.2.7

• RedHat squirrelmail-1.2.10-1.noarch.rpm
  ftp://updates.redhat.com/8.0/en/os/noarch/squirrelmail-1.2.10-1.noarch .rpm

SquirrelMail SquirrelMail 1.2.8

• RedHat squirrelmail-1.2.10-1.noarch.rpm
  ftp://updates.redhat.com/8.0/en/os/noarch/squirrelmail-1.2.10-1.noarch .rpm

SquirrelMail global.php Cross Site Scripting Vulnerability

References: