The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

Multiple cross site scripting bugs in squirrelmail have been fixed (CVE-2006-6142)

Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and delete_draft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user's webmail session. 

Also, a workaround was made for Internet Explorer <= 5: IE will attempt to guess the MIME type of attachments based on content, not the MIME header sent. Attachments could fake to be a 'harmless' JPEG, while they were in fact HTML that Internet Explorer would render.

From Red Hat Security Advisory 2007:0022 :

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4.

SquirrelMail is a standards-based webmail package written in PHP.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended.

Multiple cross site scripting bugs in squirrelmail have been fixed.
(CVE-2006-6142)

This update is a reissue, fixing some bugs that were introduced by the previous security update.

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4.

SquirrelMail is a standards-based webmail package written in PHP.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended.

http://squirrelmail.org/security/issue/2006-12-02 CVE-2006-6142 Cross site scripting in compose, draft & HTML mail viewing http://squirrelmail.org/security/issue/2006-12-03 Workaround for Internet Explorer MIME handling

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	8/2/2007	5/28/2024	critical
27455	openSUSE 10 Security Update : squirrelmail (squirrelmail-2409)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
23946	Debian DSA-1241-1 : squirrelmail - XSS	Nessus	Debian Local Security Checks	12/30/2006	1/4/2021	medium
67442	Oracle Linux 3 / 4 : squirrelmail (ELSA-2007-0022)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
27456	openSUSE 10 Security Update : squirrelmail (squirrelmail-2417)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
24288	CentOS 3 / 4 : squirrelmail (CESA-2007:0022)	Nessus	CentOS Local Security Checks	2/9/2007	1/4/2021	medium
24225	Fedora Core 6 : squirrelmail-1.4.8-3.fc6 (2007-089)	Nessus	Fedora Local Security Checks	1/18/2007	1/11/2021	medium
24317	RHEL 3 / 4 : squirrelmail (RHSA-2007:0022)	Nessus	Red Hat Local Security Checks	2/9/2007	1/14/2021	medium
24224	Fedora Core 5 : squirrelmail-1.4.8-3.fc5 (2007-088)	Nessus	Fedora Local Security Checks	1/18/2007	1/11/2021	medium

Detections

Analytics

Plugins Search

critical

medium

medium

medium

medium

medium

medium

medium

medium