Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2007-0358 advisory.

    [1.4.8-4.0.1.el4.0.1]
     - remove banners

     [1.4.8-4.0.1]
     - resolves: #239650: CVE-2007-1262 squirrelmail cross-site scripting flaw

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. (CVE-2007-1262)

Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted HTML e-mail message.
(CVE-2007-2589)

This update of squirrelmail fixes two cross-site-scripting vulnerabilities that can be used by an attacker to read opened emails (CVE-2007-1262) and to send email on behalf of the user (CVE-2007-2589).

This is a reissue of the previous update due to regressions.

This update of squirrelmail fixes two cross-site-scripting vulnerabilities that can be used by an attacker to read opened emails (CVE-2007-1262) and to send email on behalf of the user (CVE-2007-2589).

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

The SquirrelMail developers report :

Multiple cross-site scripting (XSS) vulnerabilities in the HTML filter in SquirrelMail 1.4.0 through 1.4.9a allow remote attackers to inject arbitrary web script or HTML via the (1) data: URI in an HTML e-mail attachment or (2) various non-ASCII character sets that are not properly filtered when viewed with Microsoft Internet Explorer.

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

Several HTML filtering bugs were discovered in SquirrelMail. An attacker could inject arbitrary JavaScript leading to cross-site scripting attacks by sending an e-mail viewed by a user within SquirrelMail. (CVE-2007-1262)

Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted HTML e-mail message.
(CVE-2007-2589)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues.

It was discovered that the webmail package Squirrelmail performs insufficient sanitising inside the HTML filter, which allows the injection of arbitrary web script code during the display of HTML email messages.

ID	Name	Product	Family	Severity
67501	Oracle Linux 5 : Moderate: / squirrelmail (ELSA-2007-0358)	Nessus	Oracle Linux Local Security Checks	medium
60185	Scientific Linux Security Update : squirrelmail on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
27458	openSUSE 10 Security Update : squirrelmail (squirrelmail-3944)	Nessus	SuSE Local Security Checks	medium
27457	openSUSE 10 Security Update : squirrelmail (squirrelmail-3629)	Nessus	SuSE Local Security Checks	medium
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
25305	FreeBSD : squirrelmail -- XSS in HTML filter (0e575ed3-0764-11dc-a80b-0016179b2dd5)	Nessus	FreeBSD Local Security Checks	medium
25270	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2007:0358)	Nessus	Red Hat Local Security Checks	medium
25257	CentOS 3 / 4 / 5 : squirrelmail (CESA-2007:0358)	Nessus	CentOS Local Security Checks	medium
25227	Debian DSA-1290-1 : squirrelmail - missing input sanitising	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-1262

medium

Tenable Plugins

medium

medium

medium

medium

critical

medium

medium

medium

medium