PT-2005-2879 · Squirrelmail · G/Pgp Plugin

Jmp-Esp · Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-1924

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions G/PGP Plugin versions 2.1 and earlier for Squirrelmail

Description The issue allows remote authenticated users to execute arbitrary commands via shell metacharacters in the fpr parameter to the deleteKey function in gpg keyring.php and the keyserver parameter to the gpg recv key function in gpg key functions.php. This can be exploited through various PHP files, including import key file.php, import key text.php, keyring main.php, and gpg options.php.

Recommendations For G/PGP Plugin versions 2.1 and earlier, consider disabling the deleteKey function and restricting access to the gpg recv key function until a patch is available. Avoid using the fpr and keyserver parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2005-1924

Affected Products

G/Pgp Plugin

References · 16

• 🔥 https://exploit-db.com/exploits/4173 · Exploit
• 🔥 https://exploit-db.com/exploits/4718 · Exploit
• http://secunia.com/advisories/26035 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200708-08.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-1924 · Security Note
• http://securityfocus.com/archive/1/473370/100/0/threaded · Note
• http://osvdb.org/37923 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35364 · Note
• http://osvdb.org/37924 · Note
• http://vupen.com/english/advisories/2007/2513 · Note
• http://securityfocus.com/bid/24874 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=331 · Note
• http://secunia.com/advisories/26424 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=329 · Note
• http://attrition.org/pipermail/vim/2007-July/001710.html · Note