Executive Summary

Informations
Name CVE-2009-1381 First vendor Publication 2009-05-22
Vendor Cve Last vendor Modification 2023-11-07

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1381

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12830
 
Oval ID: oval:org.mitre.oval:def:12830
Title: DSA-1802-1 squirrelmail -- several
Description: Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1578 Cross site scripting was possible through a number of pages which allowed an attacker to steal sensitive session data. CVE-2009-1579 Code injection was possible when SquirrelMail was configured to use the map_yp_alias function to authenticate users. This is not the default. CVE-2009-1580 It was possible to hijack an active user session by planting a specially crafted cookie into the user's browser. CVE-2009-1581 Specially crafted HTML emails could use the CSS positioning feature to place email content over the SquirrelMail user interface, allowing for phishing. For the old stable distribution, these problems have been fixed in version 2:1.4.9a-4. For the stable distribution, these problems have been fixed in version 2:1.4.15-4+lenny1. For the unstable distribution, these problems have been fixed in version 1.4.18-1. We recommend that you upgrade your squirrelmail package.
Family: unix Class: patch
Reference(s): DSA-1802-1
CVE-2009-1578
CVE-2009-1579
CVE-2009-1580
CVE-2009-1581
CVE-2009-1381
 Version: 7
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): squirrelmail
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:13573
 
Oval ID: oval:org.mitre.oval:def:13573
Title: DSA-1802-2 squirrelmail -- several
Description: Michal Hlavinka discovered that the fix for code execution in the map_yp_alias function, known as CVE-2009-1579 and released in DSA 1802-1, was incomplete. This update corrects the fix for that function. For the old stable distribution, this problem has been fixed in version 1.4.9a-5. For the stable distribution, this problem has been fixed in version 1.4.15-4+lenny2. For the unstable distribution, this problem has been fixed in version 1.4.19-1 We recommend that you upgrade your squirrelmail package.
Family: unix Class: patch
Reference(s): DSA-1802-2
CVE-2009-1578
CVE-2009-1579
CVE-2009-1580
CVE-2009-1581
CVE-2009-1381
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): squirrelmail
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:8413
 
Oval ID: oval:org.mitre.oval:def:8413
Title: DSA-1802 squirrelmail -- several vulnerabilities
Description: Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems: Cross site scripting was possible through a number of pages which allowed an attacker to steal sensitive session data. Code injection was possible when SquirrelMail was configured to use the map_yp_alias function to authenticate users. This is not the default. It was possible to hijack an active user session by planting a specially crafted cookie into the user's browser. Specially crafted HTML emails could use the CSS positioning feature to place email content over the SquirrelMail user interface, allowing for phishing.
Family: unix Class: patch
Reference(s): DSA-1802
CVE-2009-1578
CVE-2009-1579
CVE-2009-1580
CVE-2009-1581
CVE-2009-1381
 Version: 5
Platform(s): Debian GNU/Linux 5.0
Debian GNU/Linux 4.0
 Product(s): squirrelmail
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 11

OpenVAS Exploits

Date Description
2010-01-20 Name : Gentoo Security Advisory GLSA 201001-08 (squirrelmail)
File : nvt/glsa_201001_08.nasl
2009-09-09 Name : SuSE Security Summary SUSE-SR:2009:014
File : nvt/suse_sr_2009_014.nasl
2009-06-05 Name : Fedora Core 10 FEDORA-2009-5350 (squirrelmail)
File : nvt/fcore_2009_5350.nasl
2009-06-05 Name : Fedora Core 9 FEDORA-2009-5471 (squirrelmail)
File : nvt/fcore_2009_5471.nasl
2009-05-29 Name : SquirrelMail Command Execution Vulnerability
File : nvt/secpod_squirrelmail_cmd_exec_vuln.nasl
2009-05-25 Name : Debian Security Advisory DSA 1802-1 (squirrelmail)
File : nvt/deb_1802_1.nasl
2009-05-25 Name : Debian Security Advisory DSA 1802-2 (squirrelmail)
File : nvt/deb_1802_2.nasl
2009-05-25 Name : Mandrake Security Advisory MDVSA-2009:122 (squirrelmail)
File : nvt/mdksa_2009_122.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
54506 SquirrelMail Example map_yp_alias Username Mapping Alias Unspecified Arbitrar...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2009-1066.nasl - Type : ACT_GATHER_INFO
2010-02-25 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201001-08.nasl - Type : ACT_GATHER_INFO
2009-10-06 Name : The remote openSUSE host is missing a security update.
File : suse_squirrelmail-6457.nasl - Type : ACT_GATHER_INFO
2009-05-28 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2009-1066.nasl - Type : ACT_GATHER_INFO
2009-05-27 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2009-1066.nasl - Type : ACT_GATHER_INFO
2009-05-26 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5350.nasl - Type : ACT_GATHER_INFO
2009-05-26 Name : The remote Fedora host is missing a security update.
File : fedora_2009-5471.nasl - Type : ACT_GATHER_INFO
2009-05-20 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1802.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BUGTRAQ http://www.securityfocus.com/archive/1/503718/100/0/threaded
DEBIAN http://www.debian.org/security/2009/dsa-1802
FEDORA https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2009:122
MISC http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4...
SECUNIA http://secunia.com/advisories/35140

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
Date Informations
2023-11-07 21:47:43
  • Multiple Updates
2023-02-13 09:29:19
  • Multiple Updates
2023-02-02 21:28:57
  • Multiple Updates
2021-05-04 12:09:28
  • Multiple Updates
2021-04-22 01:09:48
  • Multiple Updates
2020-05-23 00:23:40
  • Multiple Updates
2018-10-11 00:19:35
  • Multiple Updates
2016-06-28 17:39:52
  • Multiple Updates
2016-04-26 18:46:34
  • Multiple Updates
2014-02-17 10:49:47
  • Multiple Updates
2013-05-10 23:49:16
  • Multiple Updates