Vulnerabilities > CVE-2009-1381 - Unspecified vulnerability in Squirrelmail Imap General.PHP and Squirrelmail
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN squirrelmail
nessus
Summary
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
Vulnerable Configurations
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2009-1066.NASL description An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A server-side code injection flaw was found in the SquirrelMail last seen 2020-06-01 modified 2020-06-02 plugin id 38922 published 2009-05-27 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38922 title RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:1066) NASL family Fedora Local Security Checks NASL id FEDORA_2009-5471.NASL description - Fri May 22 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.19-1 - updated to 1.4.19 - fixes CVE-2009-1579, CVE-2009-1580, CVE-2009-1581 - Tue May 19 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.18-2 - fix undefined variable aSpamIds (#501260) - Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.18-1 - update to 1.4.18 (fixes CVE-2009-1581) - Thu Dec 4 2008 Michal Hlavinka <mhlavink at redhat.com> - 1.4.17-1 - update to 1.4.17 (fixes CVE-2008-2379) - Wed Oct 1 2008 Michal Hlavinka <mhlavink at redhat.com> - 1.4.16-1 - update to 1.4.16 - resolves: #464185: CVE-2008-3663 Squirrelmail session hijacking Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 38908 published 2009-05-26 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38908 title Fedora 9 : squirrelmail-1.4.19-1.fc9 (2009-5471) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201001-08.NASL description The remote host is affected by the vulnerability described in GLSA-201001-08 (SquirrelMail: Multiple vulnerabilities) Multiple vulnerabilities were found in SquirrelMail: Niels Teusink reported multiple input sanitation flaws in certain encrypted strings in e-mail headers, related to contrib/decrypt_headers.php, PHP_SELF and the query string (aka QUERY_STRING) (CVE-2009-1578). Niels Teusink also reported that the map_yp_alias() function in functions/imap_general.php does not filter shell metacharacters in a username and that the original patch was incomplete (CVE-2009-1381, CVE-2009-1579). Tomas Hoger discovered an unspecified session fixation vulnerability (CVE-2009-1580). Luc Beurton reported that functions/mime.php does not protect the application last seen 2020-06-01 modified 2020-06-02 plugin id 44897 published 2010-02-25 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/44897 title GLSA-201001-08 : SquirrelMail: Multiple vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2009-5350.NASL description - Fri May 22 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.19-1 - updated to 1.4.19 - fixes CVE-2009-1579, CVE-2009-1580, CVE-2009-1581 - Tue May 19 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.18-2 - fix undefined variable aSpamIds (#501260) - Tue May 12 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.18-1 - updated to 1.4.18 - Wed Mar 18 2009 Michal Hlavinka <mhlavink at redhat.com> - 1.4.17-4 - don last seen 2020-06-01 modified 2020-06-02 plugin id 38905 published 2009-05-26 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/38905 title Fedora 10 : squirrelmail-1.4.19-1.fc10 (2009-5350) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1802.NASL description Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-1578 Cross site scripting was possible through a number of pages which allowed an attacker to steal sensitive session data. - CVE-2009-1579, CVE-2009-1381 Code injection was possible when SquirrelMail was configured to use the map_yp_alias function to authenticate users. This is not the default. - CVE-2009-1580 It was possible to hijack an active user session by planting a specially crafted cookie into the user last seen 2020-06-01 modified 2020-06-02 plugin id 38859 published 2009-05-20 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38859 title Debian DSA-1802-2 : squirrelmail - several vulnerabilities NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2009-1066.NASL description From Red Hat Security Advisory 2009:1066 : An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A server-side code injection flaw was found in the SquirrelMail last seen 2020-06-01 modified 2020-06-02 plugin id 67865 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67865 title Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2009-1066) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2009-1066.NASL description An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP. A server-side code injection flaw was found in the SquirrelMail last seen 2020-06-01 modified 2020-06-02 plugin id 38930 published 2009-05-28 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/38930 title CentOS 3 / 5 : squirrelmail (CESA-2009:1066) NASL family SuSE Local Security Checks NASL id SUSE_SQUIRRELMAIL-6457.NASL description The previous fix for a vulnerability that allowed an attacker to run arbitrary commands on the server was incomplete (CVE-2009-1381). last seen 2020-06-01 modified 2020-06-02 plugin id 42034 published 2009-10-06 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/42034 title openSUSE 10 Security Update : squirrelmail (squirrelmail-6457)
Statements
| contributor | Tomas Hoger |
| lastmodified | 2009-05-26 |
| organization | Red Hat |
| statement | Not vulnerable. This issue did not affect the versions of squirrelmail as shipped with Red Hat Enterprise Linux 3, 4, or 5. Updates for squirrelmail released via RHSA-2009:1066 (https://rhn.redhat.com/errata/RHSA-2009-1066.html) fixed original flaw CVE-2009-1579 without introducing CVE-2009-1381. |
References
- http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff
- http://secunia.com/advisories/35140
- http://www.debian.org/security/2009/dsa-1802
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:122
- http://www.securityfocus.com/archive/1/503718/100/0/threaded