options_identities.php in SquirrelMail 1.4.4 and earlier uses the extract function to process the $_POST variable, which allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting XSS) attacks, and write arbitrary files.

An updated squirrelmail package that fixes two security issues is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 04 Aug 2005] The previous SquirrelMail package released with this errata contained a bug which rendered the addressbook unusable.
The erratum has been updated with a package which corrects this issue.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail handled the $_POST variable.
If a user is tricked into visiting a malicious URL, the user's SquirrelMail preferences could be read or modified. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2095 to this issue.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL, or by sending them a carefully constructed HTML email message. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-1769 to this issue.

All users of SquirrelMail should upgrade to this updated package, which contains backported patches that resolve these issues.

A Squirrelmail Advisory reports :

An extract($_POST) was done in options_identities.php which allowed for an attacker to set random variables in that file. This could lead to the reading (and possible writing) of other people's preferences, cross site scripting or writing files in webserver-writable locations.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2005-007 applied.

This security update contains fixes for the following products :

  - Apache 2
  - AppKit
  - Bluetooth
  - CoreFoundation
  - CUPS
  - Directory Services
  - HItoolbox
  - Kerberos
  - loginwindow
  - Mail
  - MySQL
  - OpenSSL
  - QuartzComposerScreenSaver
  - ping
  - Safari
  - SecurityInterface
  - servermgrd
  - servermgr_ipfilter
  - SquirelMail
  - traceroute
  - WebKit
  - WebLog Server
  - X11
  - zlib

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:595 advisory.

    SquirrelMail is a standards-based webmail package written in PHP4.

    A bug was found in the way SquirrelMail handled the $_POST variable. If a     user is tricked into visiting a malicious URL, the user's SquirrelMail     preferences could be read or modified. The Common Vulnerabilities and     Exposures project assigned the name CAN-2005-2095 to this issue.

    Several cross-site scripting bugs were discovered in SquirrelMail. An     attacker could inject arbitrary Javascript or HTML content into     SquirrelMail pages by tricking a user into visiting a carefully crafted     URL, or by sending them a carefully constructed HTML email message. The     Common Vulnerabilities and Exposures project assigned the name     CAN-2005-1769 to this issue.

    All users of SquirrelMail should upgrade to this updated package, which     contains backported patches that resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2005-1769     Martijn Brinkers discovered cross-site scripting     vulnerabilities that allow remote attackers to inject     arbitrary web script or HTML in the URL and e-mail     messages.

  - CAN-2005-2095

    James Bercegay of GulfTech Security discovered a     vulnerability in the variable handling which could lead     to attackers altering other people's preferences and     possibly reading them, writing files at any location     writable for www-data and cross site scripting.

The remote host is running SquirrelMail, a webmail system written in PHP.
The version of SquirrelMail installed on the remote host is prone to multiple flaws :
 - Multiple Cross-Site Scripting Vulnerabilities.  Using a specially-crafted URL or email message, an attacker may be able to exploit these flaws, stealing cookie-based session identifiers and thereby hijacking SquirrelMail sessions.
 - Post Variable Handling Vulnerabilities - Using specially-crafted POST requests, an attacker may be able to set random variables in the file 'options_identities.php', which could lead to accessing other users' preferences, cross-site scripting attacks, and writing to arbitrary files.


According to its banner, the version of SquirrelMail installed on the remote host is prone to multiple flaws :

  - Post Variable Handling Vulnerabilities     Using specially crafted POST requests, an attacker may     be able to set random variables in the file     'options_identities.php', which could lead to accessing     other users' preferences, cross-site scripting attacks,     and writing to arbitrary files.

  - Multiple Cross-Site Scripting Vulnerabilities     Using a specially crafted URL or email message, an     attacker may be able to exploit these flaws, stealing     cookie-based session identifiers and thereby hijacking     SquirrelMail sessions.

ID	Name	Product	Family	Severity
67029	CentOS 3 / 4 : SquirrelMail (CESA-2005:595-02)	Nessus	CentOS Local Security Checks	medium
21950	CentOS 3 / 4 : SquirrelMail (CESA-2005:595)	Nessus	CentOS Local Security Checks	medium
21456	FreeBSD : squirrelmail -- _$POST variable handling allows for various attacks (7d52081f-2795-11da-bc01-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium
19463	Mac OS X Multiple Vulnerabilities (Security Update 2005-007)	Nessus	MacOS X Local Security Checks	critical
19381	RHEL 4 : squirrelmail (RHSA-2005:595)	Nessus	Red Hat Local Security Checks	medium
19196	Debian DSA-756-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium
3016	SquirrelMail < 1.4.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
18504	SquirrelMail < 1.45 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2005-2095

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium