SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   SquirrelMail Vendors:   SquirrelMail Development Team
(Red Hat Issues Fix) SquirrelMail Input Validation Flaw in webmail.php May Let Remote Users Execute Arbitrary Commands or Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1013192
SecurityTracker URL:  http://securitytracker.com/id/1013192
CVE Reference:   CVE-2005-0075, CVE-2005-0103, CVE-2005-0104, CVE-2005-0152   (Links to External Site)
Date:  Feb 15 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 1.4.4
Description:   Several input validation vulnerabilities were reported in SquirrelMail. A remote user may be able to execute arbitrary commands on the target system. A remote user may also be able to conduct cross-site scripting attacks.

The vendor reported that undefined variables in 'src/webmail.php' allow a remote user to supply specially crafted parameters to potentially cause an unauthorized file to be included and executed on the target system [CVE: CVE-2005-0103].

A remote user can also create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser [CVE: CVE-2005-0104], also due to an error in 'src/webmail.php'. The code will originate from the site running the SquirrelMail software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A missing variable initialization in 'functions/prefs.php' may allow a remote user to cause unauthorized files to be included and executed on the target system if the register_globals is set to On [CVE: CVE-2005-0075]. Jimmy Conner is credited with discovering this flaw.

An initialization error in 'src/webmail.php' allows a remote user to manipulate a URL under certain circumstances where register_globals and allow_url_fopen are both set to 'on' to cause the target server to execute arbitrary code with the privileges of the web server [CVE: CVE-2005-0152]. Grant Hollingworth is credited with discovering this flaw.

Impact:   A remote user may be able to execute arbitrary PHP code and operating system commands on the target system with the privileges of the target web service.

A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the SquirrelMail software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

Solution:   Red Hat has released a fix.

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8 squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29 squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8 squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29 squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8 squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29 squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8 squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29 squirrelmail-1.4.3a-9.EL4.noarch.rpm

Vendor URL:  www.squirrelmail.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Red Hat Enterprise)
Underlying OS Comments:  4

Message History:   This archive entry is a follow-up to the message listed below.
Jan 25 2005 SquirrelMail Input Validation Flaw in webmail.php May Let Remote Users Execute Arbitrary Commands or Conduct Cross-Site Scripting Attacks



 Source Message Contents

Subject:  [RHSA-2005:099-01] Moderate: squirrelmail security update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: squirrelmail security update
Advisory ID:       RHSA-2005:099-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2005-099.html
Issue date:        2005-02-15
Updated on:        2005-02-15
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2005-0075 CAN-2005-0103 CAN-2005-0104
- ---------------------------------------------------------------------

1. Summary:

An updated Squirrelmail package that fixes several security issues is now
available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat
Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - noarch
Red Hat Enterprise Linux Desktop version 4 - noarch
Red Hat Enterprise Linux ES version 4 - noarch
Red Hat Enterprise Linux WS version 4 - noarch

3. Problem description:

SquirrelMail is a standards-based webmail package written in PHP4.

Jimmy Conner discovered a missing variable initialization in Squirrelmail.
This flaw could allow potential insecure file inclusions on servers where
the PHP setting "register_globals" is set to "On". This is not a default or
recommended setting. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0075 to this issue.

A URL sanitisation bug was found in Squirrelmail. This flaw could allow a
cross site scripting attack when loading the URL for the sidebar. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2005-0103 to this issue.

A missing variable initialization bug was found in Squirrelmail. This flaw
could allow a cross site scripting attack. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0104 to
this issue.

Users of Squirrelmail are advised to upgrade to this updated package,
which contains backported patches to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

145387 - CAN-2005-0075 Arbitrary code injection in Squirrelmail
145967 - CAN-2005-0103 Multiple issues in squirrelmail (CAN-2005-0104)

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8  squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29  squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8  squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29  squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8  squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29  squirrelmail-1.4.3a-9.EL4.noarch.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/squirrelmail-1.4.3a-9.EL4.src.rpm
67b27d7b6cf0638bc11ebf95f7b3f7f8  squirrelmail-1.4.3a-9.EL4.src.rpm

noarch:
37baa8ae8e06f758db9f3026edb96a29  squirrelmail-1.4.3a-9.EL4.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://www.squirrelmail.org/security/issue/2005-01-20
http://www.squirrelmail.org/security/issue/2005-01-19
http://www.squirrelmail.org/security/issue/2005-01-14
http://www.php.net/register_globals
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0103
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0104

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCEc5lXlSAg2UNWIIRAgCOAJ4qeK9gQ4B3x5mngBMkSBBMclBeMgCgrdYm
fPYXx2Eq0pcBQT5NLuY5yS0=
=fP2W
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC