Overview
SquirrelMail contains a flaw in its S/MIME plug-in certificate handling routines which may allow arbitrary code to be remotely executed.
Description
From the SquirrelMail web page: SquirrelMail is a standards-based webmail package written in PHP4. It includes built-in pure PHP support for the IMAP and SMTP protocols, and all pages render in pure HTML 4.0 (with no JavaScript required) for maximum compatibility across browsers. It has very few requirements and is very easy to configure and install. SquirrelMail has all the functionality you would want from an email client, including strong MIME support, address books, and folder manipulation. |
Impact
A remote attacker may be able to supply arbitrary code to be executed in the call to exec() with the privileges of the web server. |
Solution
Apply an update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to iDefense for reporting this vulnerability, who in turn credit Karol Wiesek with the discovery of the flaw.
This document was written by Ken MacInnis based primarily on information from iDefense Inc.
Other Information
| CVE IDs: | CVE-2005-0239 |
| Severity Metric: | 4.91 |
| Date Public: | 2005-02-07 |
| Date First Published: | 2005-02-09 |
| Date Last Updated: | 2005-02-10 22:10 UTC |
| Document Revision: | 14 |