SquirrelMail compose.php session_expired_post Arbitrary Variable Overwriting

medium Nessus Plugin ID 22230

Language:

Synopsis

The remote webmail application suffers from a data modification vulnerability.

Description

The installed version of SquirrelMail allows for restoring expired sessions in an unsafe manner. Using a specially crafted expired session and compose.php, a user can leverage this issue to take control of arbitrary variables used by the affected application, which can lead to other attacks against the system, such as reading or writing of arbitrary files on the system.

Solution

Apply the patch referenced in the vendor advisory above or upgrade to SquirrelMail version 1.4.8 or later.

Plugin Details

Severity: Medium

ID: 22230

File Name: squirrelmail_session_expired_post_overwrite.nasl

Version: 1.24

Type: remote

Family: CGI abuses

Published: 8/17/2006

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Vulnerability Information

CPE: cpe:/a:squirrelmail:squirrelmail

Required KB Items: www/PHP, imap/login, imap/password

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No exploit is required

Vulnerability Publication Date: 8/11/2006

Reference Information

CVE: CVE-2006-4019

BID: 19486

Detections

Analytics