Multiple SquirrelMail Cross Site Scripting Vulnerabilities
BID:7431
Info
Multiple SquirrelMail Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 7431 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-0160 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 24 2003 12:00AM |
| Updated: | Jul 11 2009 09:07PM |
| Credit: | This vulnerability was disclosed by the vendor. |
| Vulnerable: |
SquirrelMail SquirrelMail 1.2.10 SquirrelMail SquirrelMail 1.2.9 SquirrelMail SquirrelMail 1.2.8 SquirrelMail SquirrelMail 1.2.7 SquirrelMail SquirrelMail 1.2.6 SquirrelMail SquirrelMail 1.2.5 SquirrelMail SquirrelMail 1.2.4 SquirrelMail SquirrelMail 1.2.3 SquirrelMail SquirrelMail 1.2.2 SquirrelMail SquirrelMail 1.2.1 SquirrelMail SquirrelMail 1.2 .0 SquirrelMail SquirrelMail 1.0.5 SquirrelMail SquirrelMail 1.0.4 |
| Not Vulnerable: |
SquirrelMail SquirrelMail 1.2.11 |
Discussion
Multiple SquirrelMail Cross Site Scripting Vulnerabilities
Multiple cross site scripting vulnerabilities have been discovered in several areas within SquirrelMail.
An attacker may exploit these vulnerabilities by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the webmail system.
This may allow for theft of cookie-based authentication credentials and other attacks.
This issue was reported for SquirrelMail 1.2.10; earlier versions may also be affected.
Multiple cross site scripting vulnerabilities have been discovered in several areas within SquirrelMail.
An attacker may exploit these vulnerabilities by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the webmail system.
This may allow for theft of cookie-based authentication credentials and other attacks.
This issue was reported for SquirrelMail 1.2.10; earlier versions may also be affected.
Exploit / POC
Multiple SquirrelMail Cross Site Scripting Vulnerabilities
There is no exploit required.
There is no exploit required.
Solution / Fix
Multiple SquirrelMail Cross Site Scripting Vulnerabilities
Solution:
Red Hat has released a security advisory (RHSA-2003:112-01) containing fixes which address this issue. Users are advised to upgrade as soon as possible.
Squirrelmail 1.2.11 has been released to address this vulnerability.
Conectiva has released a security advisory (CLA-2004:858) to address multiple issues in squirrelmail. Please see the referenced advisory for more information.
Fixes:
SquirrelMail SquirrelMail 1.0.4
SquirrelMail SquirrelMail 1.0.5
SquirrelMail SquirrelMail 1.2 .0
SquirrelMail SquirrelMail 1.2.1
SquirrelMail SquirrelMail 1.2.10
SquirrelMail SquirrelMail 1.2.2
SquirrelMail SquirrelMail 1.2.3
SquirrelMail SquirrelMail 1.2.4
SquirrelMail SquirrelMail 1.2.5
SquirrelMail SquirrelMail 1.2.6
SquirrelMail SquirrelMail 1.2.7
SquirrelMail SquirrelMail 1.2.8
SquirrelMail SquirrelMail 1.2.9
Solution:
Red Hat has released a security advisory (RHSA-2003:112-01) containing fixes which address this issue. Users are advised to upgrade as soon as possible.
Squirrelmail 1.2.11 has been released to address this vulnerability.
Conectiva has released a security advisory (CLA-2004:858) to address multiple issues in squirrelmail. Please see the referenced advisory for more information.
Fixes:
SquirrelMail SquirrelMail 1.0.4
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.0.5
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2 .0
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.1
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.10
-
Red Hat squirrelmail-1.2.11-1.noarch.rpm
Red Hat Linux 8.0
ftp://updates.redhat.com/8.0/en/os/noarch/squirrelmail-1.2.11-1.noarch .rpm -
Red Hat squirrelmail-1.2.11-1.noarch.rpm
Red Hat Linux 9
ftp://updates.redhat.com/9/en/os/noarch/squirrelmail-1.2.11-1.noarch.r pm -
Red Hat squirrelmail-1.2.11-1.src.rpm
Red Hat Linux 8.0
ftp://updates.redhat.com/8.0/en/os/SRPMS/squirrelmail-1.2.11-1.src.rpm -
Red Hat squirrelmail-1.2.11-1.src.rpm
Red Hat Linux 9
ftp://updates.redhat.com/9/en/os/SRPMS/squirrelmail-1.2.11-1.src.rpm -
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.2
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.3
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.4
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.5
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.6
-
Conectiva squirrelmail-1.4.3a-13677U90_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squirrelmail-1.4.3a-13677U9 0_1cl.noarch.rpm -
Conectiva squirrelmail-doc-1.4.3a-13677U90_1cl.noarch.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squirrelmail-doc-1.4.3a-136 77U90_1cl.noarch.rpm -
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.7
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php
SquirrelMail SquirrelMail 1.2.8
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php -
Terra Soft Solutions squirrelmail-1.2.11-1.noarch.rpm
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/s quirrelmail-1.2.11-1.noarch.rpm
SquirrelMail SquirrelMail 1.2.9
-
SquirrelMail squirrelmail-1.2.11
http://www.squirrelmail.org/download.php