Technical Description

Multiple vulnerabilities have been identified in SquirrelMail, which may be exploited by attackers to execute arbitrary scripting code.

The first issue is due to input validation errors in the "webmail.php" and "compose.php" scripts that do not validate the "mailto", "session" and "delete_draft" parameters, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.

The second vulnerability is due to an input validation error in the magicHTML filter, which could be exploited to conduct cross site scripting attacks.

The third flaw is due to an error when displaying attached files in Internet Explorer, which could be exploited by attackers to execute arbitrary scripting code via malicious attachments with a specially crafted MIME header.

Affected Products

SquirrelMail versions prior to 1.4.9a

Solution

Upgrade to SquirrelMail version 1.4.9a :
http://www.squirrelmail.org/download.php

Or apply patches :
http://www.squirrelmail.org/patches/1.4.9-security/stable/

References

http://www.vupen.com/english/advisories/2006/4828
http://www.squirrelmail.org/security/issue/2006-12-02
http://www.squirrelmail.org/security/issue/2006-12-03

Credits

Vulnerabilities reported by Martijn Brinkers and Cor Bosman

ChangeLog

2006-12-02 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.