Vulnerabilities in squirrelmail

From: Tom McAdam (tomc@future-i.com)
Date: Thu Jan 24 2002 - 14:53:02 PST

Next message: Barker, Brent: "BindView NetInventory NetRC hostcfg_ni password passed in clear t ext"

Previous message: Adam Herscher: "Re: squirrelmail bug"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Multiple security vulnerabilties exist in SquirrelMail < v 1.2.3 that
allow malicious HTML messages to:

* send messages appearing to come from the user
* run arbitrary javascript

Description
-----------
The compose.php script allows parameters to be passed as GETs.  Therefore
including the following in an HTML mail will send a message to xat_private:

<img 
src="compose.php?send_to=xat_private&subject=foo&bar=bar&send=1">

The read_body.php script does not check HTML tags for javascript.  A
trivial example:

<img src="javascript:alert('Oh dear')">


Resolution
----------
Upgrade to version 1.2.3 of SquirrelMail


Acknowledgements
----------------
Thanks to for Philippe Mingo for fixing this bug

Next message: Barker, Brent: "BindView NetInventory NetRC hostcfg_ni password passed in clear t ext"
Previous message: Adam Herscher: "Re: squirrelmail bug"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jan 24 2002 - 16:02:26 PST