Session fixation vulnerability in SquirrelMail before 1.4.18 allows remote attackers to hijack web sessions via a crafted cookie.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-0057 advisory.

    [1.4.8-5.0.1.el5_2.3]
    - Remove Redhat splash screen images

    [1.4.8-5.3]
    - Update patch for CVE-2008-3663 to fix a session handling regression (#480224)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is affected by the vulnerability described in GLSA-201001-08 (SquirrelMail: Multiple vulnerabilities)

    Multiple vulnerabilities were found in SquirrelMail:
    Niels     Teusink reported multiple input sanitation flaws in certain encrypted     strings in e-mail headers, related to contrib/decrypt_headers.php,     PHP_SELF and the query string (aka QUERY_STRING) (CVE-2009-1578).
    Niels Teusink also reported that the map_yp_alias() function     in functions/imap_general.php does not filter shell metacharacters in a     username and that the original patch was incomplete (CVE-2009-1381,     CVE-2009-1579).
    Tomas Hoger discovered an unspecified session fixation     vulnerability (CVE-2009-1580).
    Luc Beurton reported that functions/mime.php does not protect     the application's content from Cascading Style Sheets (CSS) positioning     in HTML e-mail messages (CVE-2009-1581).
  Impact :

    The vulnerabilities allow remote attackers to execute arbitrary code     with the privileges of the user running the web server, to hijack web     sessions via a crafted cookie, to spoof the user interface and to     conduct Cross-Site Scripting and phishing attacks, via a specially     crafted message.
  Workaround :

    There is no known workaround at this time.

Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1578     Cross site scripting was possible through a number of     pages which allowed an attacker to steal sensitive     session data.

  - CVE-2009-1579, CVE-2009-1381     Code injection was possible when SquirrelMail was     configured to use the map_yp_alias function to     authenticate users. This is not the default.

  - CVE-2009-1580     It was possible to hijack an active user session by     planting a specially crafted cookie into the user's     browser.

  - CVE-2009-1581     Specially crafted HTML emails could use the CSS     positioning feature to place email content over the     SquirrelMail user interface, allowing for phishing.

Multiple vulnerabilities have been fixed in SquirrelMail: an XSS and input sanitization bug (both CVE-2009-1578), a server-side code execution (CVE-2009-1579), a login session hijacking bug (CVE-2009-1580) and another bug that allowed phishing and XSS attacks (CVE-2009-1581).

squirrelmail is now able to work with unsigned 32bit UID values with 32-bit version of php

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.18-1

    - updated to 1.4.18

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.18-1

    - update to 1.4.18 (fixes CVE-2009-1581)

    - Thu Dec 4 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.17-1

    - update to 1.4.17 (fixes CVE-2008-2379)

    - Wed Oct 1 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.16-1

    - update to 1.4.16

    - resolves: #464185: CVE-2008-3663 Squirrelmail session       hijacking

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated squirrelmail package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.

The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory introduced a session handling flaw. Users who logged back into SquirrelMail without restarting their web browsers were assigned fixed session identifiers. A remote attacker could make use of that flaw to hijack user sessions. (CVE-2009-0030)

SquirrelMail users should upgrade to this updated package, which contains a patch to correct this issue. As well, all users who used affected versions of SquirrelMail should review their preferences.

The remote host is running SquirrelMail, a web-based email client. The installed version of SquirrelMail is affected by multiple vulnerabilities : 

 - Multiple cross-site scripting vulnerabilities.

 - A code-injection vulnerability affects the 'map_yp_alias' function which an attacker could exploit to execute arbitrary code subject to the privileges of the web server.

 - Multiple session-fixation issues could allow an attacker to steal an unsuspecting user's session.

ID	Name	Product	Family	Severity
67794	Oracle Linux 5 : squirrelmail (ELSA-2009-0057)	Nessus	Oracle Linux Local Security Checks	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
44897	GLSA-201001-08 : SquirrelMail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
38859	Debian DSA-1802-2 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium
38776	openSUSE 10 Security Update : squirrelmail (squirrelmail-6242)	Nessus	SuSE Local Security Checks	medium
38750	Fedora 10 : squirrelmail-1.4.18-1.fc10 (2009-4880)	Nessus	Fedora Local Security Checks	medium
38749	Fedora 11 : squirrelmail-1.4.18-1.fc11 (2009-4875)	Nessus	Fedora Local Security Checks	medium
38748	Fedora 9 : squirrelmail-1.4.18-1.fc9 (2009-4870)	Nessus	Fedora Local Security Checks	medium
35429	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:0057)	Nessus	Red Hat Local Security Checks	medium
35424	CentOS 3 / 4 / 5 : squirrelmail (CESA-2009:0057)	Nessus	CentOS Local Security Checks	medium
5037	SquirrelMail < 1.4.18 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high

Detections

Analytics

CVE-2009-1580

critical

Tenable Plugins

medium

high

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high