The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:099 advisory.

    SquirrelMail is a standards-based webmail package written in PHP4.

    Jimmy Conner discovered a missing variable initialization in Squirrelmail.
    This flaw could allow potential insecure file inclusions on servers where     the PHP setting register_globals is set to On. This is not a default or     recommended setting. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0075 to this issue.

    A URL sanitisation bug was found in Squirrelmail. This flaw could allow a     cross site scripting attack when loading the URL for the sidebar. The     Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned     the name CAN-2005-0103 to this issue.

    A missing variable initialization bug was found in Squirrelmail. This flaw     could allow a cross site scripting attack. The Common Vulnerabilities and     Exposures project (cve.mitre.org) has assigned the name CAN-2005-0104 to     this issue.

    Users of Squirrelmail are advised to upgrade to this updated package,     which contains backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200501-39 (SquirrelMail: Multiple vulnerabilities)

    SquirrelMail fails to properly sanitize certain strings when     decoding specially crafted strings, which can lead to PHP file     inclusion and XSS.
    Insufficient checking of incoming URLs     in prefs.php (CAN-2005-0075) and in webmail.php (CAN-2005-0103).
    Insufficient escaping of integers in webmail.php     (CAN-2005-0104).
  Impact :

    By sending a specially crafted URL, an attacker can execute     arbitrary code from the local system with the permissions of the web     server. Furthermore by enticing a user to load a specially crafted URL,     it is possible to display arbitrary remote web pages in Squirrelmail's     frameset and execute arbitrary scripts running in the context of the     victim's browser. This could lead to a compromise of the user's webmail     account, cookie theft, etc.
  Workaround :

    The arbitrary code execution is only possible with     'register_globals' set to 'On'. Gentoo ships PHP with     'register_globals' set to 'Off' by default. There are no known     workarounds for the other issues at this time.

An updated Squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 3.

SquirrelMail is a standards-based webmail package written in PHP4.

Jimmy Conner discovered a missing variable initialization in Squirrelmail. This flaw could allow potential insecure file inclusions on servers where the PHP setting 'register_globals' is set to 'On'.
This is not a default or recommended setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0075 to this issue.

A URL sanitisation bug was found in Squirrelmail. This flaw could allow a cross site scripting attack when loading the URL for the sidebar. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0103 to this issue.

A missing variable initialization bug was found in Squirrelmail. This flaw could allow a cross site scripting attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0104 to this issue.

Users of Squirrelmail are advised to upgrade to this updated package, which contains backported patches to correct these issues.

目標正在執行至少一個 SquirrelMail 執行個體，版本號碼顯示其受到一個或多個跨網站指令碼弱點影響：

- webmail.php 中的整數變數逸出不足，這允許遠端攻擊者在 SquirrelMail 網頁中加入 HTML / 指令碼 (影響 1.4.0-RC1 - 1.4.4-RC1)。 

- 對 webmail.php 中傳入的 URL 變數檢查不充分，這允許攻擊者在 SquirrelMail 框架集中包含任意遠端網頁 (影響 1.4.0-RC1 - 1.4.4-RC1)。 

- 當且僅當啟用 PHP 的 register_globals 設定時，prefs.php 中的最近變更允許攻擊者提供可將本機程式碼引入到 SquirrelMail 程式碼中的特製 URL (影響 1.4.3-RC1 - 1.4.4-RC1)。  
***** Nessus 僅根據所安裝的
***** Squirrelmail 的版本號碼來確定存在此弱點 
***** 。

ターゲットが少なくとも1つのSquirrelMailインスタンスを実行しています。そのバージョン番号からすると、以下の1つ以上のクロスサイトスクリプティングの脆弱性による影響を受けます：

- webmail.phpの整数変数のエスケープが不十分なため、リモートの攻撃者がHTML/スクリプトをSquirrelMail Webページに含める可能性があります（1.4.0-RC1-1.4.4-RC1に影響）。 

- webmail.phpの受信URL変数のチェックが不十分なため、攻撃者が任意のリモートWebページをSquirrelMailフレームセットに含める可能性があります（1.4.0-RC1-1.4.4-RC1に影響）。 

- prefs.phpの最近の変更により、PHPのregister_globals設定が有効な場合には、攻撃者が特別に細工されたURLを提供して、SquirrelMailコードにローカルコードを含める可能性があります（1.4.3-RC1-1.4.4-RC1に影響）。  
***** Nessusは、
***** インストールされているSquirrelmailのバージョン番号を確認し、 
***** ターゲットに脆弱性があると判断しました。

The target is running at least one instance of SquirrelMail whose version number suggests it is affected by one or more cross-site scripting vulnerabilities :

- Insufficient escaping of integer variables in webmail.php allows a remote attacker to include HTML / script into a SquirrelMail webpage (affects 1.4.0-RC1 - 1.4.4-RC1). 

- Insufficient checking of incoming URL vars in webmail.php allows an attacker to include arbitrary remote web pages in the SquirrelMail frameset (affects 1.4.0-RC1 - 1.4.4-RC1). 

- A recent change in prefs.php allows an attacker to provide a specially crafted URL that could include local code into the SquirrelMail code if and only if PHP's register_globals setting is enabled (affects 1.4.3-RC1 - 1.4.4-RC1).  
***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Squirrelmail 
***** installed there.

A SquirrelMail Security Advisory reports :

SquirrelMail 1.4.4 has been released to resolve a number of security issues disclosed below. It is strongly recommended that all running SquirrelMail prior to 1.4.4 upgrade to the latest release. Remote File Inclusion Manoel Zaninetti reported an issue in src/webmail.php which would allow a crafted URL to include a remote web page. This was assigned CAN-2005-0103 by the Common Vulnerabilities and Exposures.
Cross Site Scripting Issues A possible cross site scripting issue exists in src/webmail.php that is only accessible when the PHP installation is running with register_globals set to On. This issue was uncovered internally by the SquirrelMail Development team. This isssue was assigned CAN-2005-0104 by the Common Vulnerabilities and Exposures.

A second issue which was resolved in the 1.4.4-rc1 release was uncovered and assigned CAN-2004-1036 by the Common Vulnerabilities and Exposures. This issue could allow a remote user to send a specially crafted header and cause execution of script (such as JavaScript) in the client browser. Local File Inclusion A possible local file inclusion issue was uncovered by one of our developers involving custom preference handlers. This issue is only active if the PHP installation is running with register_globals set to On.

The remote host is running SquirrelMail, a webmail system written in PHP. Versions of SquirrelMail prior to 1.4.4-RC1 are vulnerable to a cross-site scripting (XSS) vulnerability. A remote attacker can exploit this flaw to run malicious code within a web browser.

ID	名稱	產品	系列	已發布	已更新	嚴重性
17185	RHEL 4 : squirrelmail (RHSA-2005:099)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/11/4	critical
16430	GLSA-200501-39 : SquirrelMail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2005/2/14	2021/1/6	high
16370	RHEL 3 : squirrelmail (RHSA-2005:135)	Nessus	Red Hat Local Security Checks	2005/2/10	2021/1/14	high
16228	SquirrelMail < 1.4.4 多個弱點	Nessus	CGI abuses	2005/1/24	2025/5/14	medium
16228	SquirrelMail < 1.4.4の複数の脆弱性	Nessus	CGI abuses	2005/1/24	2025/5/14	medium
16228	SquirrelMail < 1.4.4 Multiple Vulnerabilities	Nessus	CGI abuses	2005/1/24	2025/5/14	medium
18992	FreeBSD : squirrelmail -- XSS and remote code injection vulnerabilities (79630c0c-8dcc-45d0-9908-4087fe1d618c)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
2550	SquirrelMail < 1.4.4-RC1 webmail.php XSS	Nessus Network Monitor	CGI	2005/1/25	2019/3/6	low

偵測

搜尋 Plugin

critical

high

high

medium

medium

medium

high

low