Vulnerabilities > CVE-2006-4019 - Information Disclosure and Data Modification vulnerability in SquirrelMail Compose.PHP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. This vulnerability is addressed in the following product release: SquirrelMail, SquirrelMail, 1.4.8
Vulnerable Configurations
Exploit-Db
| description | SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite. CVE-2006-4019. Webapps exploit for PHP platform |
| id | EDB-ID:43839 |
| last seen | 2018-01-24 |
| modified | 2016-08-11 |
| published | 2016-08-11 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/43839/ |
| title | SquirrelMail < 1.4.7 - Arbitrary Variable Overwrite |
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_21B7C5502A2211DBA6E2000E0C2E438A.NASL description The SquirrelMail developers report : A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users last seen 2020-06-01 modified 2020-06-02 plugin id 22209 published 2006-08-14 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/22209 title FreeBSD : squirrelmail -- random variable overwrite vulnerability (21b7c550-2a22-11db-a6e2-000e0c2e438a) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2006-0668.NASL description A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users last seen 2020-06-01 modified 2020-06-02 plugin id 22450 published 2006-09-27 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/22450 title CentOS 3 / 4 : squirrelmail (CESA-2006:0668) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2006-0668.NASL description A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users last seen 2020-06-01 modified 2020-06-02 plugin id 22463 published 2006-09-27 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/22463 title RHEL 3 / 4 : squirrelmail (RHSA-2006:0668) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2006-0668.NASL description From Red Hat Security Advisory 2006:0668 : A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users last seen 2020-06-01 modified 2020-06-02 plugin id 67409 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67409 title Oracle Linux 4 : squirrelmail (ELSA-2006-0668) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2007-007.NASL description The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. This update contains several security fixes for the following programs : - bzip2 - CFNetwork - CoreAudio - cscope - gnuzip - iChat - Kerberos - mDNSResponder - PDFKit - PHP - Quartz Composer - Samba - SquirrelMail - Tomcat - WebCore - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 25830 published 2007-08-02 reporter This script is Copyright (C) 2007-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25830 title Mac OS X Multiple Vulnerabilities (Security Update 2007-007) NASL family CGI abuses NASL id SQUIRRELMAIL_SESSION_EXPIRED_POST_OVERWRITE.NASL description The installed version of SquirrelMail allows for restoring expired sessions in an unsafe manner. Using a specially crafted expired session and compose.php, a user can leverage this issue to take control of arbitrary variables used by the affected application, which can lead to other attacks against the system, such as reading or writing of arbitrary files on the system. last seen 2020-06-01 modified 2020-06-02 plugin id 22230 published 2006-08-17 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22230 title SquirrelMail compose.php session_expired_post Arbitrary Variable Overwriting NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1154.NASL description James Bercegay of GulfTech Security Research discovered a vulnerability in SquirrelMail where an authenticated user could overwrite random variables in the compose script. This might be exploited to read or write the preferences or attachment files of other users. last seen 2020-06-01 modified 2020-06-02 plugin id 22696 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22696 title Debian DSA-1154-1 : squirrelmail - variable overwriting NASL family Fedora Local Security Checks NASL id FEDORA_2006-913.NASL description Upstream last seen 2020-06-01 modified 2020-06-02 plugin id 24171 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24171 title Fedora Core 5 : squirrelmail-1.4.8-1.fc5 (2006-913)
Oval
| accepted | 2013-04-29T04:14:36.438-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:11533 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users. | ||||||||||||||||||||
| version | 27 |
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | CVE(CAN) ID: CVE-2004-0996,CVE-2004-2541,CVE-2005-0758,CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-0450,CVE-2007-0478,CVE-2007-1001,CVE-2007-1262,CVE-2007-1358,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717,CVE-2007-1860,CVE-2007-2403,CVE-2007-2404,CVE-2007-2405,CVE-2007-2406,CVE-2007-2407,CVE-2007-2408,CVE-2007-2409,CVE-2007-2410,CVE-2007-2442,CVE-2007-2443,CVE-2007-2446,CVE-2007-2447,CVE-2007-2589,CVE-2007-2798,CVE-2007-3742,CVE-2007-3744,CVE-2007-3745,CVE-2007-3746,CVE-2007-3747,CVE-2007-3748,CVE-2007-3944 Mac OS X是苹果家族计算机所使用的操作系统。 Apple 2007-007安全更新修复了Mac OS X中的多个安全漏洞，远程或本地攻击者可能利用这些漏洞造成多种威胁。 具体条目包括： * CVE-2005-0758 bzgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户bzgrep恶意文件执行任意指令。 * CVE-2007-2403 Mac OS X在处理FTP URI时存在漏洞，攻击者可以诱使用户处理恶意FTP URI的用户在当前FTP会话中执行任意命令。 * CVE-2007-2404 CFNetwork处理HTTP回应数据时易受数据分割攻击的影响，可能导致跨站脚本执行。 * CVE-2007-3745 CoreAudio的Java接口允许释放任意的内存地址，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3746 CoreAudio的Java接口存在堆块边界访问漏洞，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3747 CoreAudio的Java接口允许在堆块以外的内存初始化或操作对象，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2004-0996,CVE-2004-2541 Cscope存在多个漏洞，包括缓冲区溢出和不安全的方式创建临时文件，可能导致远程攻击者控制系统。 * CVE-2005-0758 zgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户zgrep恶意文件执行任意指令。 * CVE-2007-3748 iChat使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2442,CVE-2007-2443,CVE-2007-2798 MIT Kerberos kadmind实现上存在多个漏洞，攻击者可能利用这些漏洞导致拒绝服务或执行任意指认。 * CVE-2007-3744 mDNSResponder使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2405 Preview处理PDF文件的实现上存在整数溢出漏洞，攻击者可能利用此漏洞诱使用户处理恶意PDF文件控制用户系统。 * CVE-2007-1001,CVE-2007-1287,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717 PHP的实现上存在多个漏洞，可能导致各种攻击。 * CVE-2007-2406 Quartz Composer实现上存在未初始化对象指针处理漏洞，攻击者可能诱使用户处理恶意文件控制用户系统。 * CVE-2007-2446 Samba的实现在处理畸形的RPC请求时存在堆缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 * CVE-2007-2447 Samba的实现在处理畸形RPC请求时存在命令注入漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 * CVE-2007-2407 Samba的实现没有正确地处理权限的丢弃，导致磁盘限额绕过。 * CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-1262,CVE-2007-2589 SquirrelMail的实现上存在多个漏洞，可能导致跨站脚本执行。 * CVE-2005-2090,CVE-2007-0450,CVE-2007-1358,CVE-2007-1860 Tomcat实现上存在多个漏洞，可能导致跨站脚本执行和信息泄露。 * CVE-2007-2408 WebCore软件包实现上存在漏洞，可能导致不期望的Java applet执行。 * CVE-2007-0478 WebCore软件包在处理HTML标题的代码上存在漏洞，允许远程用户插入代码。 * CVE-2007-2409,CVE-2007-2410 WebCore软件包的实现上存在漏洞，可能导致浏览器信息泄露。 * CVE-2007-3742 WebKit软件包实现上存在漏洞，可能导致域名欺骗。 * CVE-2007-3944 Safari的JavaScript引擎使用的PCRE库实现上存在堆溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户访问恶意网页控制用户系统。 Apple MacOS X 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href="http://docs.info.apple.com/article.html?artnum=306172" target="_blank">http://docs.info.apple.com/article.html?artnum=306172</a> |
| id | SSV:2062 |
| last seen | 2017-11-19 |
| modified | 2007-08-02 |
| published | 2007-08-02 |
| reporter | Root |
| title | Mac OS X 2007-007更新修复多个安全漏洞 |
References
- ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc
- http://attrition.org/pipermail/vim/2006-August/000970.html
- http://docs.info.apple.com/article.html?artnum=306172
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
- http://marc.info/?l=full-disclosure&m=115532449024178&w=2
- http://secunia.com/advisories/21354
- http://secunia.com/advisories/21444
- http://secunia.com/advisories/21586
- http://secunia.com/advisories/22080
- http://secunia.com/advisories/22104
- http://secunia.com/advisories/22487
- http://secunia.com/advisories/26235
- http://securitytracker.com/id?1016689
- http://www.debian.org/security/2006/dsa-1154
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:147
- http://www.novell.com/linux/security/advisories/2006_23_sr.html
- http://www.osvdb.org/27917
- http://www.redhat.com/support/errata/RHSA-2006-0668.html
- http://www.securityfocus.com/archive/1/442980/100/0/threaded
- http://www.securityfocus.com/archive/1/442993/100/0/threaded
- http://www.securityfocus.com/bid/19486
- http://www.securityfocus.com/bid/25159
- http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch
- http://www.squirrelmail.org/security/issue/2006-08-11
- http://www.vupen.com/english/advisories/2006/3271
- http://www.vupen.com/english/advisories/2007/2732
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
- https://issues.rpath.com/browse/RPL-577
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533