Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors in (1) the URL or (2) an e-mail message.

An updated squirrelmail package that fixes two security issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 04 Aug 2005] The previous SquirrelMail package released with this errata contained a bug which rendered the addressbook unusable.
The erratum has been updated with a package which corrects this issue.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail handled the $_POST variable.
If a user is tricked into visiting a malicious URL, the user's SquirrelMail preferences could be read or modified. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2095 to this issue.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL, or by sending them a carefully constructed HTML email message. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1769 to this issue.

All users of SquirrelMail should upgrade to this updated package, which contains backported patches that resolve these issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:595 advisory.

    SquirrelMail is a standards-based webmail package written in PHP4.

    A bug was found in the way SquirrelMail handled the $_POST variable. If a     user is tricked into visiting a malicious URL, the user's SquirrelMail     preferences could be read or modified. The Common Vulnerabilities and     Exposures project assigned the name CAN-2005-2095 to this issue.

    Several cross-site scripting bugs were discovered in SquirrelMail. An     attacker could inject arbitrary Javascript or HTML content into     SquirrelMail pages by tricking a user into visiting a carefully crafted     URL, or by sending them a carefully constructed HTML email message. The     Common Vulnerabilities and Exposures project assigned the name     CAN-2005-1769 to this issue.

    All users of SquirrelMail should upgrade to this updated package, which     contains backported patches that resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-1769     Martijn Brinkers discovered cross-site scripting     vulnerabilities that allow remote attackers to inject     arbitrary web script or HTML in the URL and e-mail     messages.

  - CAN-2005-2095

    James Bercegay of GulfTech Security discovered a     vulnerability in the variable handling which could lead     to attackers altering other people's preferences and     possibly reading them, writing files at any location     writable for www-data and cross site scripting.

A SquirrelMail Security Advisory reports :

Several cross site scripting (XSS) vulnerabilities have been discovered in SquirrelMail versions 1.4.0 - 1.4.4.

The vulnerabilities are in two categories: the majority can be exploited through URL manipulation, and some by sending a specially crafted email to a victim. When done very carefully, this can cause the session of the user to be hijacked.

The remote host is affected by the vulnerability described in GLSA-200506-19 (SquirrelMail: Several XSS vulnerabilities)

    SquirrelMail is vulnerable to several cross-site scripting issues,     most reported by Martijn Brinkers.
  Impact :

    By enticing a user to read a specially crafted e-mail or using a     manipulated URL, an attacker can execute arbitrary scripts running in     the context of the victim's browser. This could lead to a compromise of     the user's webmail account, cookie theft, etc.
  Workaround :

    There is no known workaround at this time.

The remote host is running SquirrelMail, a webmail system written in PHP.
The version of SquirrelMail installed on the remote host is prone to multiple flaws :
 - Multiple Cross-Site Scripting Vulnerabilities.  Using a specially-crafted URL or email message, an attacker may be able to exploit these flaws, stealing cookie-based session identifiers and thereby hijacking SquirrelMail sessions.
 - Post Variable Handling Vulnerabilities - Using specially-crafted POST requests, an attacker may be able to set random variables in the file 'options_identities.php', which could lead to accessing other users' preferences, cross-site scripting attacks, and writing to arbitrary files.


According to its banner, the version of SquirrelMail installed on the remote host is prone to multiple flaws :

  - Post Variable Handling Vulnerabilities     Using specially crafted POST requests, an attacker may     be able to set random variables in the file     'options_identities.php', which could lead to accessing     other users' preferences, cross-site scripting attacks,     and writing to arbitrary files.

  - Multiple Cross-Site Scripting Vulnerabilities     Using a specially crafted URL or email message, an     attacker may be able to exploit these flaws, stealing     cookie-based session identifiers and thereby hijacking     SquirrelMail sessions.

ID	Name	Product	Family	Severity
67029	CentOS 3 / 4 : SquirrelMail (CESA-2005:595-02)	Nessus	CentOS Local Security Checks	medium
21950	CentOS 3 / 4 : SquirrelMail (CESA-2005:595)	Nessus	CentOS Local Security Checks	medium
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
19381	RHEL 4 : squirrelmail (RHSA-2005:595)	Nessus	Red Hat Local Security Checks	medium
19196	Debian DSA-756-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium
19151	FreeBSD : squirrelmail -- Several XSS vulnerabilities (e879ca68-e01b-11d9-a8bd-000cf18bbe54)	Nessus	FreeBSD Local Security Checks	medium
18545	GLSA-200506-19 : SquirrelMail: Several XSS vulnerabilities	Nessus	Gentoo Local Security Checks	medium
3016	SquirrelMail < 1.4.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
18504	SquirrelMail < 1.45 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2005-1769

medium

Tenable Plugins

medium

medium

critical

medium

medium

medium

medium

medium

medium