PT-2005-3037 · Squirrelmail+1 · Squirrelmail+1

James Bercegay · Published 2005-07-13 · Updated 2017-10-11 · CVE-2005-2095

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions 1.4.4 and earlier

Description: The issue allows remote attackers to modify or read the preferences of other users, conduct cross-site scripting (XSS) attacks, and write arbitrary files. This is due to the use of the extract function to process the $ POST variable in the options identities.php file.

Recommendations: For SquirrelMail versions 1.4.4 and earlier, consider disabling the options identities.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the extract function to process user-input data, such as the $ POST variable, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-2095

DSA-756-1

RHSA-2005:595

RHSA-2005_595

Affected Products

Red Hat

Squirrelmail

References · 19

• 🔥 https://exploit-db.com/exploits/43830 · Exploit
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html · Vendor Advisory
• http://debian.org/security/2005/dsa-756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2095 · Security Note
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163047 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_18_sr.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-595.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10500 · Note
• https://redhat.com/security/data/cve/CVE-2005-1769.html · Note
• http://securityfocus.com/archive/1/405202 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21359 · Note
• http://gulftech.org/?node=research&article_id=00090-07142005 · Note
• https://redhat.com/security/data/cve/CVE-2005-2095.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-595.html · Note