Secunia Advisory: SA10493 Print Advisory
Release Date: 2003-12-26
Last Update: 2003-12-27

Critical: Moderately critical
Impact: System access
Where: From remote

Software: SquirrelMail 1.x


Description:
A vulnerability has been reported in Squirrelmail, potentially allowing malicious users to execute arbitrary system commands.

The function "parseAddress()" parses email addresses in an insecure manner when encrypting emails. This may allow malicious users to include arbitrary system commands using shell meta characters like ";".

According to the vendor, the vulnerability affects Squirrelmail 1.4.0 and prior with GPG plug-in versions 1.1 and prior.

Solution:
Update to version 1.4.2.
http://www.squirrelmail.org/download.php

Provided and/or discovered by:
Bugtraq Security Systems

Changelog:
2003-12-27: Updated advisory with vendor information.

Original Advisory:
Command Injection Issue in Squirrelmail
http://www.bugtraq.org/advisories/_BSSADV-0001.txt

Source: Secunia

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

Site News

More in Site News