Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1490 advisory.

    - fix: CVE-2009-2964 : CSRF issues in all forms - extend to all forms
    - fix: CVE-2009-2964 : CSRF issues in all forms - add missing parts

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

CVE-2009-2964 squirrelmail: CSRF issues in all forms

Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker tricked a user into visiting a malicious web page, the attacker could hijack that user's authentication, inject malicious content into that user's preferences, or possibly send mail without that user's permission. (CVE-2009-2964)

SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other actions, by tricking the victim into following a link controlled by the offender.

In addition, a denial-of-service was fixed, which could be triggered when a password containing 8-bit characters was used to log in (CVE-2010-2813 ).

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. 

This security update contains fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker tricked a user into visiting a malicious web page, the attacker could hijack that user's authentication, inject malicious content into that user's preferences, or possibly send mail without that user's permission. (CVE-2009-2964)

Users of SquirrelMail should upgrade to this updated package, which contains a backported patch to correct these issues.

- Implemented page referal verification mechanism.
    (Secunia Advisory SA34627)

    - Implemented security token system. (Secunia Advisory       SA34627)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running SquirrelMail, a web-based email client.  The installed version of SquirrelMail is potentially affected by cross-site request forgery vulnerabilities on all form submissions.

ID	Name	Product	Family	Severity
67938	Oracle Linux 5 : squirrelmail (ELSA-2009-1490)	Nessus	Oracle Linux Local Security Checks	high
60676	Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
48344	Debian DSA-2091-1 : squirrelmail - No user-specific token implemented	Nessus	Debian Local Security Checks	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47024	Mac OS X Multiple Vulnerabilities (Security Update 2010-004)	Nessus	MacOS X Local Security Checks	high
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
42077	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:1490)	Nessus	Red Hat Local Security Checks	medium
42071	CentOS 3 / 4 : squirrelmail (CESA-2009:1490)	Nessus	CentOS Local Security Checks	medium
40686	Fedora 11 : squirrelmail-1.4.19-2.fc11 (2009-8822)	Nessus	Fedora Local Security Checks	medium
40678	Fedora 10 : squirrelmail-1.4.19-2.fc10 (2009-8797)	Nessus	Fedora Local Security Checks	medium
5147	SquirrelMail < 1.4.20 Multiple Vulnerabilities	Nessus Network Monitor	CGI	low

Detections

Analytics

CVE-2009-2964

high

Tenable Plugins

high

medium

medium

high

critical

high

high

medium

medium

medium

medium

low