Four vulnerabilities were discovered in squirrelmail :

  - CAN-2004-0519     Multiple cross-site scripting (XSS) vulnerabilities in     SquirrelMail 1.4.2 allow remote attackers to execute     arbitrary script as other users and possibly steal     authentication information via multiple attack vectors,     including the mailbox parameter in compose.php.

  - CAN-2004-0520

    Cross-site scripting (XSS) vulnerability in mime.php for     SquirrelMail before 1.4.3 allows remote attackers to     insert arbitrary HTML and script via the content-type     mail header, as demonstrated using read_body.php.

  - CAN-2004-0521

    SQL injection vulnerability in SquirrelMail before 1.4.3     RC1 allows remote attackers to execute unauthorized SQL     statements, with unknown impact, probably via     abook_database.php.

  - CAN-2004-0639

    Multiple cross-site scripting (XSS) vulnerabilities in     Squirrelmail 1.2.10 and earlier allow remote attackers     to inject arbitrary HTML or script via (1) the $mailer     variable in read_body.php, (2) the $senderNames_part     variable in mailbox_display.php, and possibly other     vectors including (3) the $event_title variable or (4)     the $event_text variable.

The target is running at least one instance of SquirrelMail whose version number is between 1.2.0 and 1.2.10 inclusive.  Such versions do not properly sanitize From headers, leaving users vulnerable to XSS attacks.  Further, since SquirrelMail displays From headers when listing a folder, attacks does not require a user to actually open a message, only view the folder listing.

For example, a remote attacker could effectively launch a DoS against a user by sending a message with a From header such as :

From:John Doe<script>document.cookie='PHPSESSID=xxx; path=/';</script><>

which rewrites the session ID cookie and effectively logs the user out.

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number(s) of Squirrelmail
***** installed there.

目標主機正在執行至少一個版本號碼介於 1.2.0 和 1.2.10 (含) 之間的 SquirrelMail 執行個體。這些版本未正確清理 From 標頭，導致使用者容易遭受 XSS 攻擊。此外，由於 SquirrelMail 在列出資料夾時會顯示 From 標頭，因此攻擊者不需要使用者實際開啟訊息，只需要檢視資料夾清單即可。

舉例而言，遠端攻擊者可藉由傳送包含「From」標頭的訊息，例如：

From:  John Doe<script>document.cookie='PHPSESSID=xxx; path=/';</script><>

對使用者有效地發動 DoS 攻擊，此類訊息可以重寫工作階段 ID Cookie 並有效地將使用者登出。

***** Nessus 僅根據所安裝的
***** Squirrelmail 的版本號碼來確定存在此弱點
***** 。

目标正在运行至少一个版本号介于 1.2.0 和 1.2.10 之间（含）的 SquirrelMail 实例。此类版本未正确审查 From 标头，导致用户容易遭受 XSS 攻击。此外，由于 SquirrelMail 在列出文件夹时会显示 From 标头，攻击者无需用户实际打开消息，只需要查看文件夹列表即可。

例如，远程攻击者可通过发送带有 From 标头的消息（例如：

发件人： John Doe<script>document.cookie='PHPSESSID=xxx; path=/';</script><>

（会重写会话 ID Cookie 并有效地将注销用户），从而针对用户有效发起 DoS。

***** Nessus 只通过查看目标上
***** 安装的 Squirrelmail 的版本号，
***** 便确定目标上存在此漏洞。

SquirrelMail is a web-based mail server.  There are several flaws in all versions prior to 1.4.3 that allow for remote cross-site scripting (XSS) attacks and SQL injection attacks.

ID	名稱	產品	系列	已發布	已更新	嚴重性
15372	Debian DSA-535-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	critical
14217	SquirrelMail < 1.2.11 Multiple Script XSS	Nessus	CGI abuses : XSS	2004/8/6	2024/6/4	medium
14217	SquirrelMail < 1.2.11 多個指令碼 XSS	Nessus	CGI abuses : XSS	2004/8/6	2024/6/4	medium
14217	SquirrelMail < 1.2.11 多个脚本 XSS	Nessus	CGI abuses : XSS	2004/8/6	2024/6/4	medium
1217	SquirrelMail < 1.4.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2004/8/20	2019/3/6	critical

偵測

搜尋 Plugin

critical

medium

medium

medium

critical