An updated squirrelmail package that fixes a local file disclosure flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A local file disclosure flaw was found in the way SquirrelMail loads plugins. In SquirrelMail 1.4.6 or earlier, if register_globals is on and magic_quotes_gpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web server has read-access to. This configuration is neither default nor safe, and configuring PHP with the register_globals set on is dangerous and not recommended. (CVE-2006-2842)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct this issue.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

The version of SquirrelMail installed on the remote web server fails to properly sanitize user-supplied input to the 'plugins' parameter of the 'functions/plugin.php' script before using it in a PHP 'include_once()' function.  Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id.

This update fixes a local file inclusion problem in the squirrelmail webmail frontend. The issue is tracked by the Mitre CVE ID CVE-2006-2842.

The remote host is running Squirrelmail, a web-based email client.  This version of Squirrelmail is vulnerable to a 'file include' flaw within the redirect.php script.  An attacker exploiting this flaw would be able to execute local commands.  This can lead to the reading, writing or deletion of critical data.  To exploit this flaw, the attacker would only need to be able to send web requests to the server.

ID	Name	Product	Family	Published	Updated	Severity
21915	RHEL 3 / 4 : squirrelmail (RHSA-2006:0547)	Nessus	Red Hat Local Security Checks	7/4/2006	1/14/2021	high
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	8/2/2007	5/28/2024	critical
21630	SquirrelMail plugin.php plugins Parameter Local File Inclusion	Nessus	CGI abuses	6/3/2006	4/11/2022	high
27454	openSUSE 10 Security Update : squirrelmail (squirrelmail-1837)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
22001	CentOS 3 / 4 : squirrelmail (CESA-2006:0547)	Nessus	CentOS Local Security Checks	7/5/2006	1/4/2021	high
3639	SquirrelMail < 1.4.8 Local File Inclusion	Nessus Network Monitor	CGI	6/2/2006	3/6/2019	medium

Detections

Analytics

Plugins Search

high

critical

high

high

high

medium