-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I discovered a new XSS vuln in SquirrelMail which is quite dangerous since it could be exploited simply by sending a specially crafted mail to the victim. The victim only has to read the email in order to trigger the exploit. This bug is present in latest versions (as well as older ones). I also noticed that latest Debian stable distro ships a very old version of SquirrelMail, which is vulnerable to several old XSS bugs (in addition to the new one). Detailed info is included in attached advisory. Just in case of problems with the attachment, you can download it from my site: http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt Finally, I'd like to publicly state that somebody is using my nickname (RoMaNSoFt) for mass-defacing PHP-Nuke sites (and some other nasty actions like claiming to be the author of docs written by me) in a clear attempt to incriminate myself. I'm not either a defacer, neither a cracker. So please, don't mistake that script-kiddie with the real RoMaNSoFt. Contact me for additional information or if you've been affected/attacked by this likely Moroccan kiddie. Regards from Spain, --Roman - -- PGP Fingerprint: 09BB EFCD 21ED 4E79 25FB 29E1 E47F 8A7D EAD5 6742 [Key ID: 0xEAD56742. Available at KeyServ] -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBQLh7SOR/in3q1WdCEQL4kgCgjiwOlryda2lDHgszFmg3pX6tlrIAoLhR 34XnlOcYqsDDAv3Xl2A/5rzj =Gz6D -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Mon May 31 2004 - 19:02:24 PDT