Nessus Plugin #16228

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

SquirrelMail < 1.4.4 XSS Vulnerabilities

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2005 George A. Theall

Summary:

Checks for Three XSS Vulnerabilities in SquirrelMail < 1.4.4

Version:

$Revision: 1.4 $

Cve_id:

CAN-2005-0075, CAN-2005-0103, CAN-2005-0104

Bugtraq_id:

12337

Xrefs:

-

Description:

The target is running at least one instance of SquirrelMail whose
version number suggests it is vulnerable to one or more cross-site
scripting vulnerabilities :

- Insufficient escaping of integer variables in webmail.php allows a
remote attacker to include HTML / script into a SquirrelMail webpage
(affects 1.4.0-RC1 - 1.4.4-RC1).

- Insufficient checking of incoming URL vars in webmail.php allows an
attacker to include arbitrary remote web pages in the SquirrelMail
frameset (affects 1.4.0-RC1 - 1.4.4-RC1).

- A recent change in prefs.php allows an attacker to provide a
specially crafted URL that could include local code into the
SquirrelMail code if and only if PHP's register_globals setting is
enabled (affects 1.4.3-RC1 - 1.4.4-RC1).

***** Nessus has determined the vulnerability exists on the target
***** simply by looking at the version number of Squirrelmail
***** installed there.

Solution : Upgrade to SquirrelMail 1.4.4 or later.
Risk factor : Medium