CRLF injection vulnerability in SquirrelMail 1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP commands via newline characters in the mailbox parameter of the sqimap_mailbox_select command, aka "IMAP injection."

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-0188     Martijn Brinkers and Ben Maurer found a flaw in     webmail.php that allows remote attackers to inject     arbitrary web pages into the right frame via a URL in     the right_frame parameter.

  - CVE-2006-0195     Martijn Brinkers and Scott Hughes discovered an     interpretation conflict in the MagicHTML filter that     allows remote attackers to conduct cross-site scripting     (XSS) attacks via style sheet specifiers with invalid     (1) '/*' and '*/' comments, or (2) slashes inside the     'url' keyword, which is processed by some web browsers     including Internet Explorer.

  - CVE-2006-0377     Vicente Aguilera of Internet Security Auditors, S.L.
    discovered a CRLF injection vulnerability, which allows     remote attackers to inject arbitrary IMAP commands via     newline characters in the mailbox parameter of the     sqimap_mailbox_select command, aka 'IMAP injection.'     There's no known way to exploit this yet.

An updated squirrelmail package that fixes three security and many other bug issues is now available. This update contains bug fixes of upstream squirrelmail 1.4.6 with some additional improvements to international language support.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail presents the right frame to the user. If a user can be tricked into opening a carefully crafted URL, it is possible to present the user with arbitrary HTML data.
(CVE-2006-0188)

A bug was found in the way SquirrelMail filters incoming HTML email.
It is possible to cause a victim's web browser to request remote content by opening a HTML email while running a web browser that processes certain types of invalid style sheets. Only Internet Explorer is known to process such malformed style sheets.
(CVE-2006-0195)

A bug was found in the way SquirrelMail processes a request to select an IMAP mailbox. If a user can be tricked into opening a carefully crafted URL, it is possible to execute arbitrary IMAP commands as the user viewing their mail with SquirrelMail. (CVE-2006-0377)

Users of SquirrelMail are advised to upgrade to this updated package, which contains SquirrelMail version 1.4.6 and is not vulnerable to these issues.

Multiple vulnerabilities has been discovered since 1.4.5, including IMAP injection as well as some XSS issues.

The remote host is affected by the vulnerability described in GLSA-200603-09 (SquirrelMail: XSS and IMAP command injection)

    SquirrelMail does not validate the right_frame parameter in     webmail.php, possibly allowing frame replacement or cross-site     scripting (CVE-2006-0188). Martijn Brinkers and Scott Hughes discovered     that MagicHTML fails to handle certain input correctly, potentially     leading to cross-site scripting (only Internet Explorer,     CVE-2006-0195). Vicente Aguilera reported that the     sqimap_mailbox_select function did not strip newlines from the mailbox     or subject parameter, possibly allowing IMAP command injection     (CVE-2006-0377).
  Impact :

    By exploiting the cross-site scripting vulnerabilities, an     attacker can execute arbitrary scripts running in the context of the     victim's browser. This could lead to a compromise of the user's webmail     account, cookie theft, etc. A remote attacker could exploit the IMAP     command injection to execute arbitrary IMAP commands on the configured     IMAP server.
  Workaround :

    There is no known workaround at this time.

Upgrade to version upstream 1.4.6 which solves these issues in addition to several bugs.

http://www.squirrelmail.org/changelog.php More details here.

Additionally Fedora's package contains fixes that may improve usability of squirrelmail in various non-English languages. Please report to Bug #162852 if this update causes any regressions in non-English language behavior.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The installed version of SquirrelMail fails to sanitize user-supplied input to mailbox names before passing them to an IMAP server.  An unauthenticated attacker may be able to leverage this issue to launch attacks against the underlying IMAP server or against a user's mailboxes by tricking him into clicking on a specially-formatted link in an email message. 

There are also reportedly several possible cross-site scripting flaws that could be exploited to inject arbitrary HTML and script code into a user's browser.

The installed version of SquirrelMail fails to sanitize user-supplied input to mailbox names before passing them to an IMAP server.  An unauthenticated attacker may be able to leverage this issue to launch attacks against the underlying IMAP server or against a user's mailboxes by tricking him into clicking on a specially-formatted link in an email message.  There are also reportedly several possible cross-site scripting flaws that could be exploited to inject arbitrary HTML and script code into a user's browser.

ID	Name	Product	Family	Severity
22854	Debian DSA-988-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium
21992	CentOS 3 / 4 : squirrelmail (CESA-2006:0283)	Nessus	CentOS Local Security Checks	medium
21495	FreeBSD : squirrelmail -- multiple vulnerabilities (af9018b6-a4f5-11da-bb41-0011433a9404)	Nessus	FreeBSD Local Security Checks	medium
21363	RHEL 3 / 4 : squirrelmail (RHSA-2006:0283)	Nessus	Red Hat Local Security Checks	medium
21047	GLSA-200603-09 : SquirrelMail: XSS and IMAP command injection	Nessus	Gentoo Local Security Checks	medium
20998	Fedora Core 4 : squirrelmail-1.4.6-1.fc4 (2006-133)	Nessus	Fedora Local Security Checks	medium
20970	SquirrelMail < 1.4.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium
3441	SquirrelMail < 1.4.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-0377

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium