[Please upgrade SquirrelMail.  This is a new advisory -- Raju]

This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0460422604=="
Message-Id: <[EMAIL PROTECTED]>
From: Sune Kloppenborg Jeppesen <[EMAIL PROTECTED]>
Sender: [EMAIL PROTECTED]
To: [email protected]
Cc: [email protected], [email protected],
        [EMAIL PROTECTED]
Subject: [Full-disclosure] [ GLSA 200506-19 ] SquirrelMail: Several XSS
        vulnerabilities
Date: Tue, 21 Jun 2005 22:22:38 +0200

--===============0460422604==
Content-Type: multipart/signed; boundary="nextPart1866148.JkTuMDuTKE";
        protocol="application/pgp-signature"; micalg=pgp-sha1
Content-Transfer-Encoding: 7bit

--nextPart1866148.JkTuMDuTKE
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200506-19
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: SquirrelMail: Several XSS vulnerabilities
      Date: June 21, 2005
      Bugs: #95937
        ID: 200506-19

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Squirrelmail is vulnerable to several cross-site scripting
vulnerabilities which could lead to a compromise of webmail accounts.

Background
==========

SquirrelMail is a webmail package written in PHP. It supports IMAP and
SMTP protocols.

Affected packages
=================

    -------------------------------------------------------------------
     Package                   /  Vulnerable  /             Unaffected
    -------------------------------------------------------------------
  1  mail-client/squirrelmail       < 1.4.4                   >= 1.4.4
                                                               < 1.4.0

Description
===========

SquirrelMail is vulnerable to several cross-site scripting issues, most
reported by Martijn Brinkers.

Impact
======

By enticing a user to read a specially-crafted e-mail or using a
manipulated URL, an attacker can execute arbitrary scripts running in
the context of the victim's browser. This could lead to a compromise of
the user's webmail account, cookie theft, etc.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All SquirrelMail users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.4"

Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.

References
==========

  [ 1 ] SquirrelMail Advisory
        http://www.squirrelmail.org/security/issue/2005-06-15
  [ 2 ] CAN-2005-1769
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1769

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200506-19.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
[EMAIL PROTECTED] or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

--nextPart1866148.JkTuMDuTKE
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBCuHcSzKC5hMHO6rkRAr4tAJ9LwuBVdGji7TjKpJehrSPkAOQDHgCfbOjn
HecWJC0FQdWrY31YAeXaRs0=
=E82f
-----END PGP SIGNATURE-----

--nextPart1866148.JkTuMDuTKE--

--===============0460422604==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
--===============0460422604==--

------------------------------

End of this Digest
******************

-- 
Raj Mathur                [EMAIL PROTECTED]      http://kandalaya.org/
       GPG: 78D4 FC67 367F 40E2 0DD5  0FEF C968 D0EF CC68 D17F
                      It is the mind that moves


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
linux-india-help mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-india-help

Reply via email to