Vulnerabilities > CVE-2006-6142 - Cross-Site Scripting and Input Validation vulnerability in SquirrelMail
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."
Vulnerable Configurations
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_SQUIRRELMAIL-2417.NASL description Multiple cross site scripting bugs in squirrelmail have been fixed. (CVE-2006-6142) This update is a reissue, fixing some bugs that were introduced by the previous security update. last seen 2020-06-01 modified 2020-06-02 plugin id 27456 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27456 title openSUSE 10 Security Update : squirrelmail (squirrelmail-2417) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0022.NASL description A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142) Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues. Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended. last seen 2020-06-01 modified 2020-06-02 plugin id 24317 published 2007-02-09 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/24317 title RHEL 3 / 4 : squirrelmail (RHSA-2007:0022) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1241.NASL description Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and delete_draft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user last seen 2020-06-01 modified 2020-06-02 plugin id 23946 published 2006-12-30 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/23946 title Debian DSA-1241-1 : squirrelmail - XSS NASL family Fedora Local Security Checks NASL id FEDORA_2007-088.NASL description http://squirrelmail.org/security/issue/2006-12-02 CVE-2006-6142 Cross site scripting in compose, draft & HTML mail viewing http://squirrelmail.org/security/issue/2006-12-03 Workaround for Internet Explorer MIME handling Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24224 published 2007-01-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24224 title Fedora Core 5 : squirrelmail-1.4.8-3.fc5 (2007-088) NASL family SuSE Local Security Checks NASL id SUSE_SQUIRRELMAIL-2409.NASL description Multiple cross site scripting bugs in squirrelmail have been fixed (CVE-2006-6142) last seen 2020-06-01 modified 2020-06-02 plugin id 27455 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27455 title openSUSE 10 Security Update : squirrelmail (squirrelmail-2409) NASL family Fedora Local Security Checks NASL id FEDORA_2007-089.NASL description http://squirrelmail.org/security/issue/2006-12-02 CVE-2006-6142 Cross site scripting in compose, draft & HTML mail viewing http://squirrelmail.org/security/issue/2006-12-03 Workaround for Internet Explorer MIME handling Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24225 published 2007-01-18 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24225 title Fedora Core 6 : squirrelmail-1.4.8-3.fc6 (2007-089) NASL family Fedora Local Security Checks NASL id FEDORA_2007-505.NASL description Upgrade to new upstream squirrelmail-1.4.10a. This update also fixes CVE-2007-1262 and CVE-2006-6142 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 25232 published 2007-05-16 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25232 title Fedora Core 6 : squirrelmail-1.4.10a-1.fc6 (2007-505) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2007-007.NASL description The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. This update contains several security fixes for the following programs : - bzip2 - CFNetwork - CoreAudio - cscope - gnuzip - iChat - Kerberos - mDNSResponder - PDFKit - PHP - Quartz Composer - Samba - SquirrelMail - Tomcat - WebCore - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 25830 published 2007-08-02 reporter This script is Copyright (C) 2007-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25830 title Mac OS X Multiple Vulnerabilities (Security Update 2007-007) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0022.NASL description From Red Hat Security Advisory 2007:0022 : A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142) Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues. Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended. last seen 2020-06-01 modified 2020-06-02 plugin id 67442 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67442 title Oracle Linux 3 / 4 : squirrelmail (ELSA-2007-0022) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0022.NASL description A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4. SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142) Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues. Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended. last seen 2020-06-01 modified 2020-06-02 plugin id 24288 published 2007-02-09 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/24288 title CentOS 3 / 4 : squirrelmail (CESA-2007:0022)
Oval
| accepted | 2013-04-29T04:23:55.853-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:9988 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter." | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | CVE(CAN) ID: CVE-2004-0996,CVE-2004-2541,CVE-2005-0758,CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-0450,CVE-2007-0478,CVE-2007-1001,CVE-2007-1262,CVE-2007-1358,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717,CVE-2007-1860,CVE-2007-2403,CVE-2007-2404,CVE-2007-2405,CVE-2007-2406,CVE-2007-2407,CVE-2007-2408,CVE-2007-2409,CVE-2007-2410,CVE-2007-2442,CVE-2007-2443,CVE-2007-2446,CVE-2007-2447,CVE-2007-2589,CVE-2007-2798,CVE-2007-3742,CVE-2007-3744,CVE-2007-3745,CVE-2007-3746,CVE-2007-3747,CVE-2007-3748,CVE-2007-3944 Mac OS X是苹果家族计算机所使用的操作系统。 Apple 2007-007安全更新修复了Mac OS X中的多个安全漏洞，远程或本地攻击者可能利用这些漏洞造成多种威胁。 具体条目包括： * CVE-2005-0758 bzgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户bzgrep恶意文件执行任意指令。 * CVE-2007-2403 Mac OS X在处理FTP URI时存在漏洞，攻击者可以诱使用户处理恶意FTP URI的用户在当前FTP会话中执行任意命令。 * CVE-2007-2404 CFNetwork处理HTTP回应数据时易受数据分割攻击的影响，可能导致跨站脚本执行。 * CVE-2007-3745 CoreAudio的Java接口允许释放任意的内存地址，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3746 CoreAudio的Java接口存在堆块边界访问漏洞，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3747 CoreAudio的Java接口允许在堆块以外的内存初始化或操作对象，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2004-0996,CVE-2004-2541 Cscope存在多个漏洞，包括缓冲区溢出和不安全的方式创建临时文件，可能导致远程攻击者控制系统。 * CVE-2005-0758 zgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户zgrep恶意文件执行任意指令。 * CVE-2007-3748 iChat使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2442,CVE-2007-2443,CVE-2007-2798 MIT Kerberos kadmind实现上存在多个漏洞，攻击者可能利用这些漏洞导致拒绝服务或执行任意指认。 * CVE-2007-3744 mDNSResponder使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2405 Preview处理PDF文件的实现上存在整数溢出漏洞，攻击者可能利用此漏洞诱使用户处理恶意PDF文件控制用户系统。 * CVE-2007-1001,CVE-2007-1287,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717 PHP的实现上存在多个漏洞，可能导致各种攻击。 * CVE-2007-2406 Quartz Composer实现上存在未初始化对象指针处理漏洞，攻击者可能诱使用户处理恶意文件控制用户系统。 * CVE-2007-2446 Samba的实现在处理畸形的RPC请求时存在堆缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 * CVE-2007-2447 Samba的实现在处理畸形RPC请求时存在命令注入漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 * CVE-2007-2407 Samba的实现没有正确地处理权限的丢弃，导致磁盘限额绕过。 * CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-1262,CVE-2007-2589 SquirrelMail的实现上存在多个漏洞，可能导致跨站脚本执行。 * CVE-2005-2090,CVE-2007-0450,CVE-2007-1358,CVE-2007-1860 Tomcat实现上存在多个漏洞，可能导致跨站脚本执行和信息泄露。 * CVE-2007-2408 WebCore软件包实现上存在漏洞，可能导致不期望的Java applet执行。 * CVE-2007-0478 WebCore软件包在处理HTML标题的代码上存在漏洞，允许远程用户插入代码。 * CVE-2007-2409,CVE-2007-2410 WebCore软件包的实现上存在漏洞，可能导致浏览器信息泄露。 * CVE-2007-3742 WebKit软件包实现上存在漏洞，可能导致域名欺骗。 * CVE-2007-3944 Safari的JavaScript引擎使用的PCRE库实现上存在堆溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户访问恶意网页控制用户系统。 Apple MacOS X 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href="http://docs.info.apple.com/article.html?artnum=306172" target="_blank">http://docs.info.apple.com/article.html?artnum=306172</a> |
| id | SSV:2062 |
| last seen | 2017-11-19 |
| modified | 2007-08-02 |
| published | 2007-08-02 |
| reporter | Root |
| title | Mac OS X 2007-007更新修复多个安全漏洞 |
Statements
| contributor | Mark J Cox |
| lastmodified | 2007-03-14 |
| organization | Red Hat |
| statement | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
References
- ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
- http://docs.info.apple.com/article.html?artnum=306172
- http://fedoranews.org/cms/node/2438
- http://fedoranews.org/cms/node/2439
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
- http://secunia.com/advisories/23195
- http://secunia.com/advisories/23322
- http://secunia.com/advisories/23409
- http://secunia.com/advisories/23504
- http://secunia.com/advisories/23811
- http://secunia.com/advisories/24004
- http://secunia.com/advisories/24284
- http://secunia.com/advisories/26235
- http://securitytracker.com/id?1017327
- http://sourceforge.net/project/shownotes.php?release_id=468482
- http://squirrelmail.org/security/issue/2006-12-02
- http://www.debian.org/security/2006/dsa-1241
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:226
- http://www.novell.com/linux/security/advisories/2006_29_sr.html
- http://www.novell.com/linux/security/advisories/2007_4_sr.html
- http://www.redhat.com/support/errata/RHSA-2007-0022.html
- http://www.securityfocus.com/bid/21414
- http://www.securityfocus.com/bid/25159
- http://www.vupen.com/english/advisories/2006/4828
- http://www.vupen.com/english/advisories/2007/2732
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30693
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30694
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30695
- https://issues.rpath.com/browse/RPL-849
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9988