PT-2010-4308 · Squirrelmail+1 · Squirrelmail+1

Mikhail Goriachev · Publicado 2010-08-19 · Atualizado 2017-08-17 · CVE-2010-2813

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 1.4.21

Description The issue arises from improper handling of 8-bit characters in passwords by the functions/imap general.php file. This allows remote attackers to cause a denial of service, specifically disk consumption, by making multiple IMAP login attempts with different usernames. As a result, many preferences files are created.

Recommendations For versions prior to 1.4.21, update to version 1.4.21 or later to resolve the issue. As a temporary workaround, consider restricting the number of IMAP login attempts to minimize the risk of disk consumption.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2010-2813

DSA-2091-1

RHSA-2012:0103

RHSA-2012_0103

Produtos afetados

Red Hat

Squirrelmail

Referências · 25

• https://access.redhat.com/security/cve/CVE-2010-4554 · Nota
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972 · Nota
• http://vupen.com/english/advisories/2010/2080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2813 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html · Aviso do Fabricante
• http://secunia.com/advisories/40964 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61124 · Nota
• http://debian.org/security/2010/dsa-2091 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2813 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-2813 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-0103.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-1637 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=618096 · Nota
• http://secunia.com/advisories/40971 · Aviso do Fabricante