Release Date: 2003-12-26
Last Update: 2003-12-27
Critical: Moderately critical
Impact: System access
Where: From remote
Software: SquirrelMail 1.x
Description:
A vulnerability has been reported in Squirrelmail, potentially allowing malicious users to execute arbitrary system commands.
The function "parseAddress()" parses email addresses in an insecure manner when encrypting emails. This may allow malicious users to include arbitrary system commands using shell meta characters like ";".
According to the vendor, the vulnerability affects Squirrelmail 1.4.0 and prior with GPG plug-in versions 1.1 and prior.
Solution:
Update to version 1.4.2.
http://www.squirrelmail.org/download.php
Provided and/or discovered by:
Bugtraq Security Systems
Changelog:
2003-12-27: Updated advisory with vendor information.
Original Advisory:
Command Injection Issue in Squirrelmail
http://www.bugtraq.org/advisories/_BSSADV-0001.txt
Source: Secunia