SquirrelMail webmail.php and compose.php cross-site scripting
| squirrelmail-webmail-compose-xss (30693) |  Medium Risk |
Description:
SquirrelMail is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the webmail.php and compose.php scripts. A remote attacker could exploit this vulnerability using the mailto, session, or delete_draft parameter in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Platforms Affected:
- Apple, Mac OS X Server 10.3.9
- Apple, Mac OS X Server 10.4.10
- Debian, Debian Linux 3.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 ES
- SquirrelMail, SquirrelMail prior to 1.4.9a
Remedy:
Upgrade to the latest version of SquirrelMail (version 1.4.9a or later), available from the SourceForge.net Web site. See References.
For Debian GNU/Linux:
Refer to DSA-1241-1 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux:
Refer to RHSA-2007:0022-3 for patch, upgrade, or suggested workaround information. See References.
For Mac OS:
Apply Apple Security Update 2007-007, available from the Apple Web site. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Apple Security Update 2007-007 , About Security Update 2007-007 at http://docs.info.apple.com/article.html?artnum=306172.
- Apple Web site, Apple security updates at http://docs.info.apple.com/article.html?artnum=61798.
- SourceForge.net, SquirrelMail Release 1.4.9a at http://sourceforge.net/project/shownotes.php?release_id=468482.
- SquirrelMail Web site, Cross site scripting in compose, draft & HTML mail viewing at http://squirrelmail.org/security/issue/2006-12-02.
- ASA-2007-112: squirrelmail security update (RHSA-2007-0022)
- BID-21414: SquirrelMail Multiple Cross Site Scripting and Input Validation Vulnerabilities
- BID-25159: Apple Mac OS X 2007-007 Multiple Security Vulnerabilities
- CVE-2006-6142: Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving a shortcoming in the magicHTML filter.
- DSA-1241: squirrelmail -- cross-site scripting
- MDKSA-2006:226: Updated squirrelmail packages fix vulnerabilities
- RHSA-2007-0022: Moderate: squirrelmail security update
- SA23195: SquirrelMail Multiple Cross-Site Scripting Vulnerabilities
- SA23409: SUSE Update for Multiple Packages
- SA26235: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1017327: SquirrelMail Input Validation Flaws in Compose, Draft, and HTML Viewing Functions Permit Cross-Site Scripting Attacks
- SUSE-SR:2006:029: SUSE Security Summary Report
- SUSE-SR:2007:004: SUSE Security Summary Report
- VUPEN/ADV-2006-4828: SquirrelMail Multiple Parameter Handling Client-Side Cross Site Scripting Vulnerabilities
- VUPEN/ADV-2007-2732: Apple Mac OS X Multiple Code Execution and Denial of Service Vulnerabilities
Reported:
Dec 02, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net