Multiple cross-site scripting (XSS) vulnerabilities in Squirrelmail 1.2.10 and earlier allow remote attackers to inject arbitrary HTML or script via (1) the $mailer variable in read_body.php, (2) the $senderNames_part variable in mailbox_display.php, and possibly other vectors including (3) the $event_title variable or (4) the $event_text variable.

Four vulnerabilities were discovered in squirrelmail :

  - CAN-2004-0519     Multiple cross-site scripting (XSS) vulnerabilities in     SquirrelMail 1.4.2 allow remote attackers to execute     arbitrary script as other users and possibly steal     authentication information via multiple attack vectors,     including the mailbox parameter in compose.php.

  - CAN-2004-0520

    Cross-site scripting (XSS) vulnerability in mime.php for     SquirrelMail before 1.4.3 allows remote attackers to     insert arbitrary HTML and script via the content-type     mail header, as demonstrated using read_body.php.

  - CAN-2004-0521

    SQL injection vulnerability in SquirrelMail before 1.4.3     RC1 allows remote attackers to execute unauthorized SQL     statements, with unknown impact, probably via     abook_database.php.

  - CAN-2004-0639

    Multiple cross-site scripting (XSS) vulnerabilities in     Squirrelmail 1.2.10 and earlier allow remote attackers     to inject arbitrary HTML or script via (1) the $mailer     variable in read_body.php, (2) the $senderNames_part     variable in mailbox_display.php, and possibly other     vectors including (3) the $event_title variable or (4)     the $event_text variable.

SquirrelMail is a web-based mail server.  There are several flaws in all versions prior to 1.4.3 that allow for remote cross-site scripting (XSS) attacks and SQL injection attacks.

The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive.  Such versions do not properly sanitize From headers, leaving users vulnerable to XSS attacks.  Further, since SquirrelMail displays From headers when listing a folder, attacks does not require a user to actually open a message, only view the folder listing.

For example, a remote attacker could effectively launch a DoS against a user by sending a message with a From header such as :

From:John Doe<script>document.cookie='PHPSESSID=xxx; path=/';</script><>

which rewrites the session ID cookie and effectively logs the user out.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number(s) of Squirrelmail
***** installed there.

ID	Name	Product	Family	Severity
15372	Debian DSA-535-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	critical
1217	SquirrelMail < 1.4.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
14217	SquirrelMail < 1.2.11 Multiple Script XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2004-0639

medium

Tenable Plugins

critical

critical

medium