functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.

The remote Redhat Enterprise Linux 3 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports (CVE-2010-1637)

  - functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in     passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many     IMAP login attempts with different usernames, leading to the creation of many preferences files.
    (CVE-2010-2813)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2012-0103 advisory.

    - patch for CVE-2010-2813 was not complete
    - fix: CVE-2010-1637 : Port-scans via non-standard POP3 server ports in       Mail Fetch plugin
    - fix: CVE-2010-2813 : DoS (disk space consumption) by random IMAP login       attempts with 8-bit characters in the password
    - fix: CVE-2010-4554 : Prone to clickjacking attacks
    - fix: CVE-2010-4555 : Multiple XSS flaws
    - fix: CVE-2011-2752 : CRLF injection vulnerability

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SquirrelMail security update SLSA-2012:0103 did not, unlike the erratum text stated, correct the CVE-2010-2813 issue, a flaw in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server. (CVE-2012-2124)

This update also fixes the following bugs :

  - Prior to this update, SquirrelMail could not decode     multi-line subjects properly. Consequently, the decode     header internationalization option did not properly     handle new lines or tabs at the beginning of the lines.
    This bug has been fixed and SquirrelMail now works     correctly in the described scenario.

  - Due to a bug, attachments written in HTML code on the     Windows operating system were not displayed properly     when accessed with SquirrelMail; the '!=null' string was     trimmed to '!ull'. This bug has been fixed and the     attachments are now displayed correctly in such a case.

  - Previously, e-mail messages with a Unique Identifier     (UID) larger than 2^31 bytes were unreadable when using     the squirrelmail package. With this patch the     squirrelmail package is able to read all messages     regardless of the UIDs size.

  - Due to a bug, a PHP script did not assign the proper     character set to requested variables. Consequently,     SquirrelMail could not display any e-mails. The     underlying source code has been modified and now the     squirrelmail package assigns the correct character set.

  - Due to the incorrect internationalization option located     at the i18n.php file, the squirrelmail package could not     use the GB 2312 character set. The i18n.php file has     been fixed and the GB 2312 character set works correctly     in the described scenario.

  - Previously, the preg_split() function contained a     misspelled constant, PREG_SPLIT_NI_EMPTY, which could     cause SquirrelMail to produce error messages. The name     of the constant has been corrected to     PREG_SPLIT_NO_EMPTY, and SquirrelMail no longer produces     error messages in this scenario.

  - Due to Security-Enhanced Linux (SELinux) settings,     sending e-mails from the SquirrelMail web interface was     blocked. This update adds a note to the SquirrelMail     documentation that describes how to set the SELinux     options to allow sending e-mails from the SquirrelMail     web interface.

  - Previously, the squirrelmail package did not comply with     the RFC 2822 specification about line length limits.
    Consequently, attachments with lines longer than 998     characters could not be forwarded using SquirrelMail.
    This patch modifies the underlying source code and now     SquirrelMail complies with the RFC 2822 specification as     expected.

  - Prior to this update, the squirrelmail package required     the php-common script instead of the mod_php script     during installation or upgrade of the package, which led     to a dependency error. As a result, attempting to     install or upgrade the squirrelmail package failed on     systems using the php53 packages. With this update, the     dependencies of the squirrelmail package were changed     and the installation or upgrade now works correctly in     the described scenario.

SquirrelMail is a standards-based webmail package written in PHP.

A cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
A remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.
(CVE-2010-4555)

An input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)

It was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)

SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)

A flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.
(CVE-2010-2813)

A flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)

Users of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.

An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

SquirrelMail is a standards-based webmail package written in PHP.

A cross-site scripting (XSS) flaw was found in the way SquirrelMail performed the sanitization of HTML style tag content. A remote attacker could use this flaw to send a specially crafted Multipurpose Internet Mail Extensions (MIME) message that, when opened by a victim, would lead to arbitrary web script execution in the context of their SquirrelMail session. (CVE-2011-2023)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
A remote attacker could possibly use these flaws to execute arbitrary web script in the context of a victim's SquirrelMail session.
(CVE-2010-4555)

An input sanitization flaw was found in the way SquirrelMail handled the content of various HTML input fields. A remote attacker could use this flaw to alter user preference values via a newline character contained in the input for these fields. (CVE-2011-2752)

It was found that the SquirrelMail Empty Trash and Index Order pages did not protect against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker could trick a user, who was logged into SquirrelMail, into visiting a specially crafted URL, the attacker could empty the victim's trash folder or alter the ordering of the columns on the message index page. (CVE-2011-2753)

SquirrelMail was allowed to be loaded into an HTML sub-frame, allowing a remote attacker to perform a clickjacking attack against logged in users and possibly gain access to sensitive user data. With this update, the SquirrelMail main frame can only be loaded into the top most browser frame. (CVE-2010-4554)

A flaw was found in the way SquirrelMail handled failed log in attempts. A user preference file was created when attempting to log in with a password containing an 8-bit character, even if the username was not valid. A remote attacker could use this flaw to eventually consume all hard disk space on the target SquirrelMail server.
(CVE-2010-2813)

A flaw was found in the SquirrelMail Mail Fetch plug-in. If an administrator enabled this plug-in, a SquirrelMail user could use this flaw to port scan the local network the server was on. (CVE-2010-1637)

Users of SquirrelMail should upgrade to this updated package, which contains backported patches to correct these issues.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-001 applied. This update contains multiple security-related fixes for the following components :

  - Apache
  - ATS
  - ColorSync
  - CoreAudio
  - CoreMedia
  - CoreText
  - curl
  - Data Security
  - dovecot
  - filecmds
  - libresolv
  - libsecurity
  - OpenGL
  - PHP
  - QuickTime
  - SquirrelMail
  - Subversion
  - Tomcat
  - X11

SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other actions, by tricking the victim into following a link controlled by the offender.

In addition, a denial-of-service was fixed, which could be triggered when a password containing 8-bit characters was used to log in (CVE-2010-2813 ).

The remote host is running SquirrelMail, a web-based email client.

Versions of SquirrelMail earlier than 1.4.21 are potentially affected by a denial-of-service vulnerability.  By submitting a random login with 8-bit characters in the password, it is possible to cause SquirrelMail to create a preferences file even if the login is not valid.  An attacker, exploiting this flaw, could create enough files to cause the server to run out of disk space.

Fixes literal processing of 8-bit usernames/passwords during login (CVE-2010-2813): * http://squirrelmail.org/security/issue/2010-07-23

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199606	RHEL 3 : squirrelmail (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
68452	Oracle Linux 5 : squirrelmail (ELSA-2012-0103)	Nessus	Oracle Linux Local Security Checks	medium
63604	Scientific Linux Security Update : squirrelmail on SL5.x (noarch) (20130108)	Nessus	Scientific Linux Local Security Checks	medium
61240	Scientific Linux Security Update : squirrelmail on SL4.x, SL5.x (20120208)	Nessus	Scientific Linux Local Security Checks	medium
57870	RHEL 4 / 5 : squirrelmail (RHSA-2012:0103)	Nessus	Red Hat Local Security Checks	medium
57864	CentOS 4 / 5 : squirrelmail (CESA-2012:0103)	Nessus	CentOS Local Security Checks	medium
57798	Mac OS X Multiple Vulnerabilities (Security Update 2012-001) (BEAST)	Nessus	MacOS X Local Security Checks	critical
48344	Debian DSA-2091-1 : squirrelmail - No user-specific token implemented	Nessus	Debian Local Security Checks	medium
5629	SquirrelMail < 1.4.21 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
48305	Fedora 13 : squirrelmail-1.4.21-1.fc13 (2010-11422)	Nessus	Fedora Local Security Checks	medium
48304	Fedora 12 : squirrelmail-1.4.21-1.fc12 (2010-11410)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2813

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium