Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail before 1.4.18 and NaSMail before 1.7 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php; (2) PHP_SELF; and (3) the query string (aka QUERY_STRING).

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1066 advisory.

    - fix broken patch for CVE-2009-1579
    - fix broken patch for CVE-2009-1579
    - fix: CVE-2009-1581 : CSS positioning vulnerability
    - fix: CVE-2009-1579 : Server-side code injection in map_yp_alias username map

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A server-side code injection flaw was found in the SquirrelMail 'map_yp_alias' function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the 'map_yp_alias' function, an unauthenticated, remote attacker using a specially crafted username could use this flaw to execute arbitrary code with the privileges of the web server.
(CVE-2009-1579)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578)

It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581)

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is affected by the vulnerability described in GLSA-201001-08 (SquirrelMail: Multiple vulnerabilities)

    Multiple vulnerabilities were found in SquirrelMail:
    Niels     Teusink reported multiple input sanitation flaws in certain encrypted     strings in e-mail headers, related to contrib/decrypt_headers.php,     PHP_SELF and the query string (aka QUERY_STRING) (CVE-2009-1578).
    Niels Teusink also reported that the map_yp_alias() function     in functions/imap_general.php does not filter shell metacharacters in a     username and that the original patch was incomplete (CVE-2009-1381,     CVE-2009-1579).
    Tomas Hoger discovered an unspecified session fixation     vulnerability (CVE-2009-1580).
    Luc Beurton reported that functions/mime.php does not protect     the application's content from Cascading Style Sheets (CSS) positioning     in HTML e-mail messages (CVE-2009-1581).
  Impact :

    The vulnerabilities allow remote attackers to execute arbitrary code     with the privileges of the user running the web server, to hijack web     sessions via a crafted cookie, to spoof the user interface and to     conduct Cross-Site Scripting and phishing attacks, via a specially     crafted message.
  Workaround :

    There is no known workaround at this time.

An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A server-side code injection flaw was found in the SquirrelMail 'map_yp_alias' function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the 'map_yp_alias' function, an unauthenticated, remote attacker using a specially crafted username could use this flaw to execute arbitrary code with the privileges of the web server.
(CVE-2009-1579)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578)

It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581)

Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

The remote Redhat Enterprise Linux 4 / 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2009:1066 advisory.

    SquirrelMail is a standards-based webmail package written in PHP.

    A server-side code injection flaw was found in the SquirrelMail     map_yp_alias function. If SquirrelMail was configured to retrieve a     user's IMAP server address from a Network Information Service (NIS) server     via the map_yp_alias function, an unauthenticated, remote attacker using     a specially-crafted username could use this flaw to execute arbitrary code     with the privileges of the web server. (CVE-2009-1579)

    Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. An     attacker could construct a carefully crafted URL, which once visited by an     unsuspecting user, could cause the user's web browser to execute malicious     script in the context of the visited SquirrelMail web page. (CVE-2009-1578)

    It was discovered that SquirrelMail did not properly sanitize Cascading     Style Sheets (CSS) directives used in HTML mail. A remote attacker could     send a specially-crafted email that could place mail content above     SquirrelMail's controls, possibly allowing phishing and cross-site     scripting attacks. (CVE-2009-1581)

    Users of squirrelmail should upgrade to this updated package, which     contains backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1578     Cross site scripting was possible through a number of     pages which allowed an attacker to steal sensitive     session data.

  - CVE-2009-1579, CVE-2009-1381     Code injection was possible when SquirrelMail was     configured to use the map_yp_alias function to     authenticate users. This is not the default.

  - CVE-2009-1580     It was possible to hijack an active user session by     planting a specially crafted cookie into the user's     browser.

  - CVE-2009-1581     Specially crafted HTML emails could use the CSS     positioning feature to place email content over the     SquirrelMail user interface, allowing for phishing.

The installed version of SquirrelMail fails to sanitize user-supplied input before using it in the 'contrib/decrypt_headers.php' script to dynamically generate HTML. 

An unauthenticated attacker can exploit this issue to launch cross-site scripting attacks against the affected application. 

There are also reportedly several other issues, including cross-site scripting vulnerabilities, a code injection vulnerability, and a session fixation vulnerability, though Nessus has not tested for these.

Multiple vulnerabilities have been fixed in SquirrelMail: an XSS and input sanitization bug (both CVE-2009-1578), a server-side code execution (CVE-2009-1579), a login session hijacking bug (CVE-2009-1580) and another bug that allowed phishing and XSS attacks (CVE-2009-1581).

squirrelmail is now able to work with unsigned 32bit UID values with 32-bit version of php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.18-1

    - updated to 1.4.18

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.18-1

    - update to 1.4.18 (fixes CVE-2009-1581)

    - Thu Dec 4 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.17-1

    - update to 1.4.17 (fixes CVE-2008-2379)

    - Wed Oct 1 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.16-1

    - update to 1.4.16

    - resolves: #464185: CVE-2008-3663 Squirrelmail session       hijacking

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running SquirrelMail, a web-based email client. The installed version of SquirrelMail is affected by multiple vulnerabilities : 

 - Multiple cross-site scripting vulnerabilities.

 - A code-injection vulnerability affects the 'map_yp_alias' function which an attacker could exploit to execute arbitrary code subject to the privileges of the web server.

 - Multiple session-fixation issues could allow an attacker to steal an unsuspecting user's session.

ID	Name	Product	Family	Severity
67865	Oracle Linux 5 : squirrelmail (ELSA-2009-1066)	Nessus	Oracle Linux Local Security Checks	medium
60590	Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
44897	GLSA-201001-08 : SquirrelMail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
38930	CentOS 3 / 5 : squirrelmail (CESA-2009:1066)	Nessus	CentOS Local Security Checks	medium
38922	RHEL 4 / 5 : squirrelmail (RHSA-2009:1066)	Nessus	Red Hat Local Security Checks	medium
38859	Debian DSA-1802-2 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium
38793	SquirrelMail contrib/decrypt_headers.php XSS	Nessus	CGI abuses : XSS	medium
38776	openSUSE 10 Security Update : squirrelmail (squirrelmail-6242)	Nessus	SuSE Local Security Checks	medium
38750	Fedora 10 : squirrelmail-1.4.18-1.fc10 (2009-4880)	Nessus	Fedora Local Security Checks	medium
38749	Fedora 11 : squirrelmail-1.4.18-1.fc11 (2009-4875)	Nessus	Fedora Local Security Checks	medium
38748	Fedora 9 : squirrelmail-1.4.18-1.fc9 (2009-4870)	Nessus	Fedora Local Security Checks	medium
5037	SquirrelMail < 1.4.18 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2009-1578

medium

Tenable Plugins

medium

medium

high

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

high