Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in squirrelmail
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in squirrelmail
ID: MDKSA-2006:147
Distribution: Mandriva
Plattformen: Mandriva Corporate 3.0
Datum: Di, 22. August 2006, 23:04
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019
Applikationen: Squirrelmail

Originalnachricht

This is a multi-part message in MIME format...

------------=_1156280674-9299-1522


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:147
http://www.mandriva.com/security/
_______________________________________________________________________

Package : squirrelmail
Date : August 22, 2006
Affected: Corporate 3.0
_______________________________________________________________________

Problem Description:

Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail
1.5.1 and earlier, when register_globals is enabled, allows remote
attackers to inject arbitrary HTML via the mailbox parameter
(CVE-2006-3174).

NOTE: The squirrelmail developers dispute this issue, but the relevant
code has been reworked to be sure. The patch has been applied to the
Mandriva packages.

Dynamic variable evaluation vulnerability in compose.php in
SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite
arbitrary program variables and read or write the attachments and
references of other users (CVE-2006-4019).

Updated packages are patched to address these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019
_______________________________________________________________________

Updated Packages:

Corporate 3.0:
06470a6a27239654feffdec4586b464f
corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm
5d3b85ad3d7797f72a234e5608ec5500
corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm
0ce03cf1cd50e51f8c1658878abbb1f3
corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm

Corporate 3.0/X86_64:
f5f5bddbabeebc495cda7fdb4e0a990e
x86_64/corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm
696d2c1669024ddf4ed11b3b2ec1cc42
x86_64/corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm
0ce03cf1cd50e51f8c1658878abbb1f3
x86_64/corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE60L4mqjQ0CJFipgRAtfeAJwOCIOsyVOC5fsncBhpUZZTdfTOfACfUG/C
tr/j8TSkalpbaWlSraYk6p8=
=l3s2
-----END PGP SIGNATURE-----


------------=_1156280674-9299-1522
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1156280674-9299-1522--
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung