The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

From Red Hat Security Advisory 2009:1066 :

An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A server-side code injection flaw was found in the SquirrelMail 'map_yp_alias' function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the 'map_yp_alias' function, an unauthenticated, remote attacker using a specially crafted username could use this flaw to execute arbitrary code with the privileges of the web server.
(CVE-2009-1579)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578)

It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581)

Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201001-08 (SquirrelMail: Multiple vulnerabilities)

    Multiple vulnerabilities were found in SquirrelMail:
    Niels     Teusink reported multiple input sanitation flaws in certain encrypted     strings in e-mail headers, related to contrib/decrypt_headers.php,     PHP_SELF and the query string (aka QUERY_STRING) (CVE-2009-1578).
    Niels Teusink also reported that the map_yp_alias() function     in functions/imap_general.php does not filter shell metacharacters in a     username and that the original patch was incomplete (CVE-2009-1381,     CVE-2009-1579).
    Tomas Hoger discovered an unspecified session fixation     vulnerability (CVE-2009-1580).
    Luc Beurton reported that functions/mime.php does not protect     the application's content from Cascading Style Sheets (CSS) positioning     in HTML e-mail messages (CVE-2009-1581).
  Impact :

    The vulnerabilities allow remote attackers to execute arbitrary code     with the privileges of the user running the web server, to hijack web     sessions via a crafted cookie, to spoof the user interface and to     conduct Cross-Site Scripting and phishing attacks, via a specially     crafted message.
  Workaround :

    There is no known workaround at this time.

The previous fix for a vulnerability that allowed an attacker to run arbitrary commands on the server was incomplete (CVE-2009-1381).

An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP.

A server-side code injection flaw was found in the SquirrelMail 'map_yp_alias' function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the 'map_yp_alias' function, an unauthenticated, remote attacker using a specially crafted username could use this flaw to execute arbitrary code with the privileges of the web server.
(CVE-2009-1579)

Multiple cross-site scripting (XSS) flaws were found in SquirrelMail.
An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578)

It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581)

Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

- Fri May 22 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.19-1

    - updated to 1.4.19

    - fixes CVE-2009-1579, CVE-2009-1580, CVE-2009-1581

    - Tue May 19 2009 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.18-2

    - fix undefined variable aSpamIds (#501260)

    - Tue May 12 2009 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.18-1

    - update to 1.4.18 (fixes CVE-2009-1581)

    - Thu Dec 4 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.17-1

    - update to 1.4.17 (fixes CVE-2008-2379)

    - Wed Oct 1 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.16-1

    - update to 1.4.16

    - resolves: #464185: CVE-2008-3663 Squirrelmail session       hijacking

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fri May 22 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.19-1

    - updated to 1.4.19

    - fixes CVE-2009-1579, CVE-2009-1580, CVE-2009-1581

    - Tue May 19 2009 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.18-2

    - fix undefined variable aSpamIds (#501260)

    - Tue May 12 2009 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.18-1

    - updated to 1.4.18

    - Wed Mar 18 2009 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.17-4

    - don't use white text (invisible on white paper) for       highlighting in conf.pl (#427217)

  - Tue Mar 17 2009 Michal Hlavinka <mhlavink at redhat.com>
    - 1.4.17-3

    - dont use colors in conf.pl by default (#427217)

    - Thu Dec 4 2008 Michal Hlavinka <mhalvink at       redhat.com> - 1.4.17-2

    - add missing locales

    - Thu Dec 4 2008 Michal Hlavinka <mhlavink at       redhat.com> - 1.4.17-1

    - update to 1.4.17 (fixes CVE-2008-2379)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several remote vulnerabilities have been discovered in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1578     Cross site scripting was possible through a number of     pages which allowed an attacker to steal sensitive     session data.

  - CVE-2009-1579, CVE-2009-1381     Code injection was possible when SquirrelMail was     configured to use the map_yp_alias function to     authenticate users. This is not the default.

  - CVE-2009-1580     It was possible to hijack an active user session by     planting a specially crafted cookie into the user's     browser.

  - CVE-2009-1581     Specially crafted HTML emails could use the CSS     positioning feature to place email content over the     SquirrelMail user interface, allowing for phishing.

ID	Name	Product	Family	Severity
67865	Oracle Linux 3 / 4 / 5 : squirrelmail (ELSA-2009-1066)	Nessus	Oracle Linux Local Security Checks	medium
44897	GLSA-201001-08 : SquirrelMail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
42034	openSUSE 10 Security Update : squirrelmail (squirrelmail-6457)	Nessus	SuSE Local Security Checks	medium
38930	CentOS 3 / 5 : squirrelmail (CESA-2009:1066)	Nessus	CentOS Local Security Checks	medium
38922	RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:1066)	Nessus	Red Hat Local Security Checks	medium
38908	Fedora 9 : squirrelmail-1.4.19-1.fc9 (2009-5471)	Nessus	Fedora Local Security Checks	medium
38905	Fedora 10 : squirrelmail-1.4.19-1.fc10 (2009-5350)	Nessus	Fedora Local Security Checks	medium
38859	Debian DSA-1802-2 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2009-1381

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium