Cross-site scripting (XSS) vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message.

From Red Hat Security Advisory 2009:0010 :

An updated squirrelmail package that resolves various security issues is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.

Ivan Markovic discovered a cross-site scripting (XSS) flaw in SquirrelMail caused by insufficient HTML mail sanitization. A remote attacker could send a specially crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or attachment was opened by the user. (CVE-2008-2379)

It was discovered that SquirrelMail allowed cookies over insecure connections (ie did not restrict cookies to HTTPS connections). An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to sniff the user's network communication, could use this flaw to obtain the user's session cookie, if a user made an HTTP request to the server. (CVE-2008-3663)

Note: After applying this update, all session cookies set for SquirrelMail sessions started over HTTPS connections will have the 'secure' flag set. That is, browsers will only send such cookies over an HTTPS connection. If needed, you can revert to the previous behavior by setting the configuration option '$only_secure_cookies' to 'false' in SquirrelMail's /etc/squirrelmail/config.php configuration file.

Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

Ivan Markovic discovered a cross-site scripting (XSS) flaw in SquirrelMail caused by insufficient HTML mail sanitization. A remote attacker could send a specially crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or attachment was opened by the user. (CVE-2008-2379)

It was discovered that SquirrelMail allowed cookies over insecure connections (ie did not restrict cookies to HTTPS connections). An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to sniff the user's network communication, could use this flaw to obtain the user's session cookie, if a user made an HTTP request to the server. (CVE-2008-3663)

Note: After applying this update, all session cookies set for SquirrelMail sessions started over HTTPS connections will have the 'secure' flag set. That is, browsers will only send such cookies over an HTTPS connection. If needed, you can revert to the previous behavior by setting the configuration option '$only_secure_cookies' to 'false' in SquirrelMail's /etc/squirrelmail/config.php configuration file.

update to 1.4.7 fixes: malformed HTML mail message script insertion

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

An updated squirrelmail package that resolves various security issues is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.

Ivan Markovic discovered a cross-site scripting (XSS) flaw in SquirrelMail caused by insufficient HTML mail sanitization. A remote attacker could send a specially crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or attachment was opened by the user. (CVE-2008-2379)

It was discovered that SquirrelMail allowed cookies over insecure connections (ie did not restrict cookies to HTTPS connections). An attacker who controlled the communication channel between a user and the SquirrelMail server, or who was able to sniff the user's network communication, could use this flaw to obtain the user's session cookie, if a user made an HTTP request to the server. (CVE-2008-3663)

Note: After applying this update, all session cookies set for SquirrelMail sessions started over HTTPS connections will have the 'secure' flag set. That is, browsers will only send such cookies over an HTTPS connection. If needed, you can revert to the previous behavior by setting the configuration option '$only_secure_cookies' to 'false' in SquirrelMail's /etc/squirrelmail/config.php configuration file.

Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

This update brings squirrelmail to version 1.4.10a, fixing a previous regression in cookie handling (novell bug 446400) and a XSS problem (CVE-2008-2379).

Ivan Markovic discovered that SquirrelMail, a webmail application, did not sufficiently sanitise incoming HTML email, allowing an attacker to perform cross site scripting through sending a malicious HTML email.

update to 1.4.17 fixes XSS issue caused by an insufficient html mail sanitation

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Insufficient input checks could allow remote attackers to conduct a cross site scripting (XSS) attack (CVE-2008-2379).

Squirrelmail team reports :

An issue was fixed that allowed an attacker to send specially- crafted hyperlinks in a message that could execute cross-site scripting (XSS) when the user viewed the message in SquirrelMail.

ID	Name	Product	Family	Severity
67786	Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2009-0010)	Nessus	Oracle Linux Local Security Checks	medium
60519	Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
37734	Fedora 10 : squirrelmail-1.4.17-2.fc10 (2008-10748)	Nessus	Fedora Local Security Checks	medium
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
35357	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:0010)	Nessus	Red Hat Local Security Checks	medium
35353	CentOS 3 / 4 / 5 : squirrelmail (CESA-2009:0010)	Nessus	CentOS Local Security Checks	medium
35184	openSUSE 10 Security Update : squirrelmail (squirrelmail-5860)	Nessus	SuSE Local Security Checks	medium
35083	Debian DSA-1682-1 : squirrelmail - insufficient input sanitising	Nessus	Debian Local Security Checks	medium
35048	Fedora 8 : squirrelmail-1.4.17-1.fc8 (2008-10918)	Nessus	Fedora Local Security Checks	medium
35044	Fedora 9 : squirrelmail-1.4.17-1.fc9 (2008-10740)	Nessus	Fedora Local Security Checks	medium
35040	openSUSE 10 Security Update : squirrelmail (squirrelmail-5835)	Nessus	SuSE Local Security Checks	medium
35037	FreeBSD : squirrelmail -- XSS vulnerability (d1ce8a4f-c235-11dd-8cbc-00163e000016)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-2379

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium