PT-2004-1731 · Squirrelmail · Squirrelmail

Published 2004-07-09 · Updated 2017-07-11 · CVE-2004-0639

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Squirrelmail versions 1.2.10 and earlier

Description The issue allows remote attackers to inject arbitrary HTML or script via several vectors, including the mailer variable in read body.php, the senderNames part variable in mailbox display.php, and possibly other vectors such as the event title variable or the event text variable.

Recommendations For Squirrelmail versions 1.2.10 and earlier, as a temporary workaround, consider restricting access to the read body.php and mailbox display.php scripts until a patch is available. Avoid using the mailer and senderNames part variables in these scripts until the issue is resolved. Additionally, restrict the use of the event title and event text variables if they are confirmed to be vulnerable.

Exploit

Fix

Related Identifiers

CVE-2004-0639

DSA-535

Affected Products

Squirrelmail

References · 10

• 🔥 http://securityfocus.com/bid/10450 · Exploit
• 🔥 https://exploit-db.com/exploits/24167 · Exploit
• http://rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0639 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000858 · Vendor Advisory
• http://debian.org/security/2004/dsa-535 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=257973 · Note
• http://marc.info/?l=bugtraq&m=108611554415078&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16285 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0639 · Note