drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in squirrelmail
Name: |
Zwei Probleme in squirrelmail |
|
ID: |
MDKSA-2006:147 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Corporate 3.0 |
|
Datum: |
Di, 22. August 2006, 23:04 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019 |
|
Applikationen: |
Squirrelmail |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1156280674-9299-1522
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:147 http://www.mandriva.com/security/ _______________________________________________________________________ Package : squirrelmail Date : August 22, 2006 Affected: Corporate 3.0 _______________________________________________________________________ Problem Description: Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter (CVE-2006-3174). NOTE: The squirrelmail developers dispute this issue, but the relevant code has been reworked to be sure. The patch has been applied to the Mandriva packages. Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and references of other users (CVE-2006-4019). Updated packages are patched to address these issues. _______________________________________________________________________
References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019 _______________________________________________________________________ Updated Packages: Corporate 3.0: 06470a6a27239654feffdec4586b464f corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm 5d3b85ad3d7797f72a234e5608ec5500 corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm 0ce03cf1cd50e51f8c1658878abbb1f3 corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm
Corporate 3.0/X86_64: f5f5bddbabeebc495cda7fdb4e0a990e x86_64/corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm 696d2c1669024ddf4ed11b3b2ec1cc42 x86_64/corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm 0ce03cf1cd50e51f8c1658878abbb1f3 x86_64/corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFE60L4mqjQ0CJFipgRAtfeAJwOCIOsyVOC5fsncBhpUZZTdfTOfACfUG/C tr/j8TSkalpbaWlSraYk6p8= =l3s2 -----END PGP SIGNATURE-----
------------=_1156280674-9299-1522 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________
------------=_1156280674-9299-1522--
|
|
|
|