PT-2001-2300 · Squirrelmail · Squirrelmail

Published 2001-07-02 · Updated 2008-09-05 · CVE-2001-1159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions 1.0.4 and earlier

Description The issue allows remote attackers to view sensitive files and execute arbitrary code. This is due to the improper initialization of certain PHP variables in load prefs.php and supporting include files. Attackers can exploit this by using options such as config php and data dir to view sensitive files, or by uploading a message that could be interpreted as PHP via options order.php.

Recommendations For SquirrelMail versions 1.0.4 and earlier, update to a version that properly initializes PHP variables to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2001-1159

Affected Products

Squirrelmail

References · 6

• http://securityfocus.com/bid/2968 · Vendor Advisory
• http://iss.net/security_center/static/6775.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1159 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-07/0029.html · Vendor Advisory
• http://squirrelmail.org/changelog.php · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1159 · Note