PHP remote file inclusion vulnerability in functions/plugin.php in SquirrelMail 1.4.6 and earlier, if register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the plugins array parameter. NOTE: this issue has been disputed by third parties, who state that Squirrelmail provides prominent warnings to the administrator when register_globals is enabled. Since the varieties of administrator negligence are uncountable, perhaps this type of issue should not be included in CVE. However, the original developer has posted a security advisory, so there might be relevant real-world environments under which this vulnerability is applicable

This update fixes a local file inclusion problem in the squirrelmail webmail frontend. The issue is tracked by the Mitre CVE ID CVE-2006-2842.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

An updated squirrelmail package that fixes a local file disclosure flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A local file disclosure flaw was found in the way SquirrelMail loads plugins. In SquirrelMail 1.4.6 or earlier, if register_globals is on and magic_quotes_gpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web server has read-access to. This configuration is neither default nor safe, and configuring PHP with the register_globals set on is dangerous and not recommended. (CVE-2006-2842)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct this issue.

The version of SquirrelMail installed on the remote web server fails to properly sanitize user-supplied input to the 'plugins' parameter of the 'functions/plugin.php' script before using it in a PHP 'include_once()' function.  Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id.

The remote host is running Squirrelmail, a web-based email client.  This version of Squirrelmail is vulnerable to a 'file include' flaw within the redirect.php script.  An attacker exploiting this flaw would be able to execute local commands.  This can lead to the reading, writing or deletion of critical data.  To exploit this flaw, the attacker would only need to be able to send web requests to the server.

ID	Name	Product	Family	Severity
27454	openSUSE 10 Security Update : squirrelmail (squirrelmail-1837)	Nessus	SuSE Local Security Checks	high
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
22001	CentOS 3 / 4 : squirrelmail (CESA-2006:0547)	Nessus	CentOS Local Security Checks	high
21915	RHEL 3 / 4 : squirrelmail (RHSA-2006:0547)	Nessus	Red Hat Local Security Checks	high
21630	SquirrelMail plugin.php plugins Parameter Local File Inclusion	Nessus	CGI abuses	high
3639	SquirrelMail < 1.4.8 Local File Inclusion	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-2842

critical

Tenable Plugins

high

critical

high

high

high

medium