PT-2001-2300 · Squirrelmail · Squirrelmail

Publicado 2001-07-02 · Atualizado 2008-09-05 · CVE-2001-1159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.0.4 and earlier

Description The issue allows remote attackers to view sensitive files and execute arbitrary code. This is due to the improper initialization of certain PHP variables in load prefs.php and supporting include files. Attackers can exploit this by using options such as config php and data dir to view sensitive files, or by uploading a message that could be interpreted as PHP via options order.php.

Recommendations For SquirrelMail versions 1.0.4 and earlier, update to a version that properly initializes PHP variables to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2001-1159

Produtos afetados

Squirrelmail

Referências · 6

• http://securityfocus.com/bid/2968 · Aviso do Fabricante
• http://iss.net/security_center/static/6775.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2001-1159 · Nota de Segurança
• http://squirrelmail.org/changelog.php · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1159 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2001-07/0029.html · Aviso do Fabricante