PT-2009-4069 · Squirrelmail+1 · Squirrelmail+1

Luc Beurton · Published 2009-05-14 · Updated 2017-09-29 · CVE-2009-1581

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18

Description: The issue allows remote attackers to spoof the user interface and conduct cross-site scripting (XSS) and phishing attacks via a crafted HTML e-mail message. This is due to the application's content not being protected from Cascading Style Sheets (CSS) positioning in HTML e-mail messages.

Recommendations: For versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML e-mail messages until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1581

DSA-1802-1

RHSA-2009:1066

RHSA-2009_1066

Affected Products

Red Hat

Squirrelmail

References · 29

• https://redhat.com/archives/fedora-package-announce/2009-May/msg00577.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2009-1066.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-May/msg00572.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-May/msg00566.html · Vendor Advisory
• http://debian.org/security/2009/dsa-1802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1581 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:110 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1296 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=500356 · Patch
• http://secunia.com/advisories/35052 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html · Vendor Advisory
• http://secunia.com/advisories/35073 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50463 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10441 · Note
• http://support.apple.com/kb/HT4188 · Note