The version of SquirrelMail installed on the remote web server fails to properly sanitize user-supplied input to the 'plugins' parameter of the 'functions/plugin.php' script before using it in a PHP 'include_once()' function.  Provided PHP's 'register_globals' setting is enabled, an unauthenticated attacker may be able to exploit this issue to view arbitrary files or to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user id.

An updated squirrelmail package that fixes a local file disclosure flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A local file disclosure flaw was found in the way SquirrelMail loads plugins. In SquirrelMail 1.4.6 or earlier, if register_globals is on and magic_quotes_gpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web server has read-access to. This configuration is neither default nor safe, and configuring PHP with the register_globals set on is dangerous and not recommended. (CVE-2006-2842)

Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct this issue.

遠端 Web 伺服器上安裝的 SquirrelMail 版本未正確清理「functions/plugin.php」指令碼中「plugins」參數的使用者輸入內容，便將其用於 PHP 的「include_once()」函式。若已啟用 PHP 的「register_globals」設定，未經驗證的攻擊者或可利用此問題，在遠端主機上檢視任意檔案或執行任意 PHP 程式碼，但這需要具有 Web 伺服器使用者 ID 的權限。

リモートWebサーバーにインストールされているSquirrelMailのバージョンは、PHP「include_once()」関数で使用される前に、「functions/plugin.php」スクリプトの「plugins」パラメーターに対するユーザー指定の入力のサニタイズに失敗します。PHPの「register_globals」設定が有効になっている場合は、認証されていない攻撃者が、この問題を悪用して、WebサーバーユーザーIDの権限に従って、リモートホストで任意のファイルを表示したり、任意のPHPコードを実行したりする可能性があります。

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

This update fixes a local file inclusion problem in the squirrelmail webmail frontend. The issue is tracked by the Mitre CVE ID CVE-2006-2842.

The remote host is running Squirrelmail, a web-based email client.  This version of Squirrelmail is vulnerable to a 'file include' flaw within the redirect.php script.  An attacker exploiting this flaw would be able to execute local commands.  This can lead to the reading, writing or deletion of critical data.  To exploit this flaw, the attacker would only need to be able to send web requests to the server.

ID	名稱	產品	系列	已發布	已更新	嚴重性
21630	SquirrelMail plugin.php plugins Parameter Local File Inclusion	Nessus	CGI abuses	2006/6/3	2022/4/11	high
21915	RHEL 3 / 4 : squirrelmail (RHSA-2006:0547)	Nessus	Red Hat Local Security Checks	2006/7/4	2021/1/14	high
21630	SquirrelMail plugin.php plugins 參數本機檔案引入	Nessus	CGI abuses	2006/6/3	2022/4/11	high
21630	SquirrelMail plugin.php pluginsパラメーターのローカルファイルインクルージョン	Nessus	CGI abuses	2006/6/3	2022/4/11	high
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	2007/8/2	2024/5/28	critical
22001	CentOS 3 / 4 : squirrelmail (CESA-2006:0547)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	high
27454	openSUSE 10 Security Update : squirrelmail (squirrelmail-1837)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
3639	SquirrelMail < 1.4.8 Local File Inclusion	Nessus Network Monitor	CGI	2006/6/2	2019/3/6	medium

偵測

搜尋 Plugin

high

high

high

high

critical

high

high

medium