Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML.

A SquirrelMail Security Advisory reports :

SquirrelMail 1.4.4 has been released to resolve a number of security issues disclosed below. It is strongly recommended that all running SquirrelMail prior to 1.4.4 upgrade to the latest release. Remote File Inclusion Manoel Zaninetti reported an issue in src/webmail.php which would allow a crafted URL to include a remote web page. This was assigned CAN-2005-0103 by the Common Vulnerabilities and Exposures.
Cross Site Scripting Issues A possible cross site scripting issue exists in src/webmail.php that is only accessible when the PHP installation is running with register_globals set to On. This issue was uncovered internally by the SquirrelMail Development team. This isssue was assigned CAN-2005-0104 by the Common Vulnerabilities and Exposures.

A second issue which was resolved in the 1.4.4-rc1 release was uncovered and assigned CAN-2004-1036 by the Common Vulnerabilities and Exposures. This issue could allow a remote user to send a specially crafted header and cause execution of script (such as JavaScript) in the client browser. Local File Inclusion A possible local file inclusion issue was uncovered by one of our developers involving custom preference handlers. This issue is only active if the PHP installation is running with register_globals set to On.

The remote host is missing Security Update 2005-001. This security update contains a number of enhancements for the following programs :

 - at commands
 - ColorSync
 - libxml2
 - Mail
 - PHP
 - Safari
 - SquirrelMail
 

he remote host is missing Security Update 2005-001. This security update contains a number of fixes for the following programs :

  - at commands
  - ColorSync
  - libxml2
  - Mail
  - PHP
  - Safari
  - SquirrelMail

These programs have multiple vulnerabilities which may allow a remote attacker to execute arbitrary code.

An updated SquirrelMail package that fixes a cross-site scripting vulnerability is now available.

SquirrelMail is a webmail package written in PHP.

A cross-site scripting bug has been found in SquirrelMail. This issue could allow an attacker to send a mail with a carefully crafted header, which could result in causing the victim's machine to execute a malicious script. The Common Vulnerabilities and Exposures project has assigned the name CVE-2004-1036 to this issue.

Additionally, the following issues have been addressed :

  - updated splash screens - HIGASHIYAMA Masato's patch to     improve Japanese support - real 1.4.3a tarball -     config_local.php and default_pref in /etc/squirrelmail/     to match upstream RPM.

Please note that it is possible that upgrading to this package may remove your SquirrelMail configuration files due to a bug in the RPM package. Upgrading will prevent this from happening in the future.

Users of SquirrelMail are advised to upgrade to this updated package which contains a patched version of SquirrelMail version 1.43a and is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200411-25 (SquirrelMail: Encoded text XSS vulnerability)

    SquirrelMail fails to properly sanitize certain strings when decoding     specially crafted headers.
  Impact :

    By enticing a user to read a specially crafted e-mail, an attacker can     execute arbitrary scripts running in the context of the victim's     browser. This could lead to a compromise of the user's webmail account,     cookie theft, etc.
  Workaround :

    There is no known workaround at this time.

The remote host is running SquirrelMail, a webmail system written in PHP.

Versions of SquirrelMail prior to 1.4.4 are affected by an email HTML injection issue.  A remote attacker can exploit this flaw to gain access to the users' accounts.

ID	Name	Product	Family	Severity
18992	FreeBSD : squirrelmail -- XSS and remote code injection vulnerabilities (79630c0c-8dcc-45d0-9908-4087fe1d618c)	Nessus	FreeBSD Local Security Checks	high
2555	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus Network Monitor	Web Clients	critical
16251	Mac OS X Multiple Vulnerabilities (Security Update 2005-001)	Nessus	MacOS X Local Security Checks	high
16053	RHEL 3 : squirrelmail (RHSA-2004:654)	Nessus	Red Hat Local Security Checks	medium
15736	GLSA-200411-25 : SquirrelMail: Encoded text XSS vulnerability	Nessus	Gentoo Local Security Checks	medium
15718	SquirrelMail decodeHeader Arbitrary HTML Injection	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2004-1036

medium

Tenable Plugins

high

critical

high

medium

medium

medium