Multiple cross-site scripting (XSS) vulnerabilities in SquirrelMail 1.4.0 through 1.4.9 allow remote attackers to inject arbitrary web script or HTML via the (1) mailto parameter in (a) webmail.php, the (2) session and (3) delete_draft parameters in (b) compose.php, and (4) unspecified vectors involving "a shortcoming in the magicHTML filter."

From Red Hat Security Advisory 2007:0022 :

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4.

SquirrelMail is a standards-based webmail package written in PHP.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended.

Multiple cross site scripting bugs in squirrelmail have been fixed.
(CVE-2006-6142)

This update is a reissue, fixing some bugs that were introduced by the previous security update.

Multiple cross site scripting bugs in squirrelmail have been fixed (CVE-2006-6142)

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4.

SquirrelMail is a standards-based webmail package written in PHP.

Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended.

http://squirrelmail.org/security/issue/2006-12-02 CVE-2006-6142 Cross site scripting in compose, draft & HTML mail viewing http://squirrelmail.org/security/issue/2006-12-03 Workaround for Internet Explorer MIME handling

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Martijn Brinkers discovered cross-site scripting vulnerabilities in the mailto parameter of webmail.php, the session and delete_draft parameters of compose.php and through a shortcoming in the magicHTML filter. An attacker could abuse these to execute malicious JavaScript in the user's webmail session. 

Also, a workaround was made for Internet Explorer <= 5: IE will attempt to guess the MIME type of attachments based on content, not the MIME header sent. Attachments could fake to be a 'harmless' JPEG, while they were in fact HTML that Internet Explorer would render.

ID	Name	Product	Family	Severity
67442	Oracle Linux 3 / 4 : squirrelmail (ELSA-2007-0022)	Nessus	Oracle Linux Local Security Checks	medium
27456	openSUSE 10 Security Update : squirrelmail (squirrelmail-2417)	Nessus	SuSE Local Security Checks	medium
27455	openSUSE 10 Security Update : squirrelmail (squirrelmail-2409)	Nessus	SuSE Local Security Checks	medium
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
24317	RHEL 3 / 4 : squirrelmail (RHSA-2007:0022)	Nessus	Red Hat Local Security Checks	medium
24288	CentOS 3 / 4 : squirrelmail (CESA-2007:0022)	Nessus	CentOS Local Security Checks	medium
24225	Fedora Core 6 : squirrelmail-1.4.8-3.fc6 (2007-089)	Nessus	Fedora Local Security Checks	medium
24224	Fedora Core 5 : squirrelmail-1.4.8-3.fc5 (2007-088)	Nessus	Fedora Local Security Checks	medium
23946	Debian DSA-1241-1 : squirrelmail - XSS	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2006-6142

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

medium