PT-2004-1636 · Squirrelmail · Squirrelmail

Paul Lesniewski · Published 2004-06-08 · Updated 2017-07-11 · CVE-2004-0524

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 4.0

Description A buffer overflow issue exists in the chpasswd command within the Change passwd plugin. This allows local users to potentially gain root privileges by providing a long user name.

Recommendations For versions prior to 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the chpasswd command to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2004-0524

Affected Products

Squirrelmail

References · 9

• 🔥 http://securityfocus.com/bid/10166 · Exploit
• 🔥 https://exploit-db.com/exploits/417 · Exploit
• 🔥 https://exploit-db.com/exploits/273 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-0524 · Security Note
• http://marc.info/?l=bugtraq&m=108222863917958&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15889 · Note
• http://secunia.com/advisories/11415 · Note
• http://squirrelmail.org/plugin_view.php?id=117 · Note
• http://marc.info/?l=bugtraq&m=108311782032370&w=2 · Note