Executive Summary
| Summary | |
|---|---|
| Title | New squirrelmail packages fix information disclosure |
| Informations | |||
|---|---|---|---|
| Name | DSA-1154 | First vendor Publication | 2006-08-20 |
| Vendor | Debian | Last vendor Modification | 2006-08-20 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 6.4 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| James Bercegay of GulfTech Security Research disovered a vulnerability in SquirrelMail where an authenticated user could overwrite random variables in the compose script. This might be exploited to read or write the preferences or attachment files of other users. For the stable distribution (sarge) this problem has been fixed in version 1.4.4-9. For the unstable distribution (sid) this problem has been fixed in version 1.4.8-1. We recommend that you upgrade your squirrelmail package. |
Original Source
| Url : http://www.debian.org/security/2006/dsa-1154 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:11533 | |||
| Oval ID: | oval:org.mitre.oval:def:11533 | ||
| Title: | Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. | ||
| Description: | Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-4019 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-02-27 | Name : Fedora Update for squirrelmail FEDORA-2007-088 File : nvt/gb_fedora_2007_088_squirrelmail_fc5.nasl |
| 2008-09-04 | Name : FreeBSD Ports: ja-squirrelmail File : nvt/freebsd_ja-squirrelmail0.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1154-1 (squirrelmail) File : nvt/deb_1154_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 27917 | SquirrelMail compose.php Arbitrary Variable Manipulation Squirrelmail contains a flaw that may allow a malicious user to overwrite arbitrary variables in the file compose.php. It is possible that the flaw may allow user preferences or file attachments to be overwritten, resulting in a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2006-0668.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-007.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-913.nasl - Type : ACT_GATHER_INFO |
| 2006-10-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1154.nasl - Type : ACT_GATHER_INFO |
| 2006-09-27 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2006-0668.nasl - Type : ACT_GATHER_INFO |
| 2006-09-27 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2006-0668.nasl - Type : ACT_GATHER_INFO |
| 2006-08-17 | Name : The remote webmail application suffers from a data modification vulnerability. File : squirrelmail_session_expired_post_overwrite.nasl - Type : ACT_ATTACK |
| 2006-08-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_21b7c5502a2211dba6e2000e0c2e438a.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:26:08 |
|
