Cross-site scripting (XSS) vulnerability in SqWebMail 5.0.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message containing Internet Explorer "Conditional Comments" such as "[if]" and "[endif]".

Several Cross Site Scripting vulnerabilities were discovered in SqWebmail. A remote attacker could exploit this to execute arbitrary JavaScript or other active HTML embeddable content in the web browser of an SqWebmail user by sending specially crafted emails to him.

Please note that the 'sqwebmail' package is not officially supported by Ubuntu (it is in the 'universe' section of the archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jakob Balle discovered that with 'Conditional Comments' in Internet Explorer it is possible to hide JavaScript code in comments that will be executed when the browser views a malicious email via sqwebmail.
Successful exploitation requires that the user is using Internet Explorer.

Jakob Balle discovered a vulnerability in the handling of attachments in sqwebmail, a web mail application provided by the courier mail suite, which can be exploited by an attacker to conduct script insertion attacks.

ID	Name	Product	Family	Severity
20617	Ubuntu 4.10 / 5.04 : courier vulnerabilities (USN-201-1)	Nessus	Ubuntu Local Security Checks	medium
19789	Debian DSA-820-1 : courier - missing input sanitising	Nessus	Debian Local Security Checks	medium
19563	Debian DSA-793-1 : courier - missing input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2005-2820

medium

Tenable Plugins

medium

medium

medium