PT-2010-4308 · Squirrelmail+1 · Squirrelmail+1

Mikhail Goriachev · Published 2010-08-19 · Updated 2017-08-17 · CVE-2010-2813

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SquirrelMail versions prior to 1.4.21

Description The issue arises from improper handling of 8-bit characters in passwords by the functions/imap general.php file. This allows remote attackers to cause a denial of service, specifically disk consumption, by making multiple IMAP login attempts with different usernames. As a result, many preferences files are created.

Recommendations For versions prior to 1.4.21, update to version 1.4.21 or later to resolve the issue. As a temporary workaround, consider restricting the number of IMAP login attempts to minimize the risk of disk consumption.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-2813

DSA-2091-1

RHSA-2012:0103

RHSA-2012_0103

Affected Products

Red Hat

Squirrelmail

References · 25

• http://vupen.com/english/advisories/2010/2080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2813 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html · Vendor Advisory
• http://secunia.com/advisories/40964 · Vendor Advisory
• http://debian.org/security/2010/dsa-2091 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-0103.html · Vendor Advisory
• http://secunia.com/advisories/40971 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html · Vendor Advisory
• http://squirrelmail.org/security/issue/2010-07-23 · Vendor Advisory
• http://vupen.com/english/advisories/2010/2070 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2010-4554 · Note
• http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61124 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2813 · Note