[Forgot Password]
Login  Register Subscribe

23631

 
 

115038

 
 

96174

 
 

909

 
 

78077

 
 

109

Paid content will be excluded from the download.


Download | Alert*
OVAL

CESA-2009:1066 -- centos 5 x86_64 squirrelmail

ID: oval:org.secpod.oval:def:202170Date: (C)2012-01-31   (M)2017-10-04
Class: PATCHFamily: unix




SquirrelMail is a standards-based webmail package written in PHP. A server-side code injection flaw was found in the SquirrelMail "map_yp_alias" function. If SquirrelMail was configured to retrieve a user"s IMAP server address from a Network Information Service server via the "map_yp_alias" function, an unauthenticated, remote attacker using a specially-crafted username could use this flaw to execute arbitrary code with the privileges of the web server. Multiple cross-site scripting flaws were found in SquirrelMail. An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user"s web browser to execute malicious script in the context of the visited SquirrelMail web page. It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets directives used in HTML mail. A remote attacker could send a specially-crafted email that could place mail content above SquirrelMail"s controls, possibly allowing phishing and cross-site scripting attacks. Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

Platform:
CentOS 5
Product:
squirrelmail
Reference:
CESA-2009:1066
CVE-2009-1578
CVE-2009-1579
CVE-2009-1581
CVE    3
CVE-2009-1581
CVE-2009-1579
CVE-2009-1578
CPE    2
cpe:/o:centos:centos:5
cpe:/a:squirrelmail:squirrelmail

© 2013 SecPod Technologies