Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and preferences of other users.

From Red Hat Security Advisory 2006:0668 :

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users' preferences or attachments. (CVE-2006-4019)

Users of SquirrelMail should upgrade to this erratum package, which contains SquirrelMail 1.4.8 to correct this issue. This package also contains a number of additional patches to correct various bugs.

Note: After installing this update, users are advised to restart their httpd service to ensure that the new version functions correctly.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

James Bercegay of GulfTech Security Research discovered a vulnerability in SquirrelMail where an authenticated user could overwrite random variables in the compose script. This might be exploited to read or write the preferences or attachment files of other users.

A new squirrelmail package that fixes a security issue as well as several bugs is now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users' preferences or attachments. (CVE-2006-4019)

Users of SquirrelMail should upgrade to this erratum package, which contains SquirrelMail 1.4.8 to correct this issue. This package also contains a number of additional patches to correct various bugs.

Note: After installing this update, users are advised to restart their httpd service to ensure that the new version functions correctly.

The installed version of SquirrelMail allows for restoring expired sessions in an unsafe manner.  Using a specially crafted expired session and compose.php, a user can leverage this issue to take control of arbitrary variables used by the affected application, which can lead to other attacks against the system, such as reading or writing of arbitrary files on the system.

The SquirrelMail developers report :

A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments.

ID	Name	Product	Family	Severity
67409	Oracle Linux 4 : squirrelmail (ELSA-2006-0668)	Nessus	Oracle Linux Local Security Checks	medium
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
22696	Debian DSA-1154-1 : squirrelmail - variable overwriting	Nessus	Debian Local Security Checks	medium
22463	RHEL 3 / 4 : squirrelmail (RHSA-2006:0668)	Nessus	Red Hat Local Security Checks	medium
22450	CentOS 3 / 4 : squirrelmail (CESA-2006:0668)	Nessus	CentOS Local Security Checks	medium
22230	SquirrelMail compose.php session_expired_post Arbitrary Variable Overwriting	Nessus	CGI abuses	medium
22209	FreeBSD : squirrelmail -- random variable overwrite vulnerability (21b7c550-2a22-11db-a6e2-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-4019

critical

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium