Upgrade to version upstream 1.4.6 which solves these issues in addition to several bugs.

http://www.squirrelmail.org/changelog.php More details here.

Additionally Fedora's package contains fixes that may improve usability of squirrelmail in various non-English languages. Please report to Bug #162852 if this update causes any regressions in non-English language behavior.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered since 1.4.5, including IMAP injection as well as some XSS issues.

An updated squirrelmail package that fixes three security and many other bug issues is now available. This update contains bug fixes of upstream squirrelmail 1.4.6 with some additional improvements to international language support.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SquirrelMail is a standards-based webmail package written in PHP4.

A bug was found in the way SquirrelMail presents the right frame to the user. If a user can be tricked into opening a carefully crafted URL, it is possible to present the user with arbitrary HTML data.
(CVE-2006-0188)

A bug was found in the way SquirrelMail filters incoming HTML email.
It is possible to cause a victim's web browser to request remote content by opening a HTML email while running a web browser that processes certain types of invalid style sheets. Only Internet Explorer is known to process such malformed style sheets.
(CVE-2006-0195)

A bug was found in the way SquirrelMail processes a request to select an IMAP mailbox. If a user can be tricked into opening a carefully crafted URL, it is possible to execute arbitrary IMAP commands as the user viewing their mail with SquirrelMail. (CVE-2006-0377)

Users of SquirrelMail are advised to upgrade to this updated package, which contains SquirrelMail version 1.4.6 and is not vulnerable to these issues.

Several vulnerabilities have been discovered in Squirrelmail, a commonly used webmail system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-0188     Martijn Brinkers and Ben Maurer found a flaw in     webmail.php that allows remote attackers to inject     arbitrary web pages into the right frame via a URL in     the right_frame parameter.

  - CVE-2006-0195     Martijn Brinkers and Scott Hughes discovered an     interpretation conflict in the MagicHTML filter that     allows remote attackers to conduct cross-site scripting     (XSS) attacks via style sheet specifiers with invalid     (1) '/*' and '*/' comments, or (2) slashes inside the     'url' keyword, which is processed by some web browsers     including Internet Explorer.

  - CVE-2006-0377     Vicente Aguilera of Internet Security Auditors, S.L.
    discovered a CRLF injection vulnerability, which allows     remote attackers to inject arbitrary IMAP commands via     newline characters in the mailbox parameter of the     sqimap_mailbox_select command, aka 'IMAP injection.'     There's no known way to exploit this yet.

SquirrelMailのインストールされているバージョンは、IMAPサーバーに渡す前に、メールボックス名に対するユーザー指定の入力のサニタイズに失敗します。認証されていない攻撃者が、この問題を利用して、メールメッセージ内の特別な形式のリンクをクリックするように仕向けることで、基礎となるIMAPサーバーまたはユーザーのメールボックスに対して攻撃を仕掛ける可能性があります。 

また、報告によると、ユーザーのブラウザに任意のHTMLコードやスクリプトコードを挿入するために悪用される可能性のある、いくつかのクロスサイトスクリプティングの欠陥が存在します。

安裝的 SquirrelMail 版本未清理使用者輸入的信箱名稱，便將其傳送至 IMAP 伺服器。未經驗證的攻擊者可利用此問題，誘騙使用者點擊電子郵件訊息中特殊格式的連結，對基礎 IMAP 伺服器或使用者的信箱發動攻擊。 

據報告，可能還有數個跨網站指令碼瑕疵，攻擊者可利用這些瑕疵在使用者的瀏覽器中插入任意 HTML 和指令碼。

The installed version of SquirrelMail fails to sanitize user-supplied input to mailbox names before passing them to an IMAP server.  An unauthenticated attacker may be able to leverage this issue to launch attacks against the underlying IMAP server or against a user's mailboxes by tricking him into clicking on a specially-formatted link in an email message. 

There are also reportedly several possible cross-site scripting flaws that could be exploited to inject arbitrary HTML and script code into a user's browser.

The remote host is affected by the vulnerability described in GLSA-200603-09 (SquirrelMail: XSS and IMAP command injection)

    SquirrelMail does not validate the right_frame parameter in     webmail.php, possibly allowing frame replacement or cross-site     scripting (CVE-2006-0188). Martijn Brinkers and Scott Hughes discovered     that MagicHTML fails to handle certain input correctly, potentially     leading to cross-site scripting (only Internet Explorer,     CVE-2006-0195). Vicente Aguilera reported that the     sqimap_mailbox_select function did not strip newlines from the mailbox     or subject parameter, possibly allowing IMAP command injection     (CVE-2006-0377).
  Impact :

    By exploiting the cross-site scripting vulnerabilities, an     attacker can execute arbitrary scripts running in the context of the     victim's browser. This could lead to a compromise of the user's webmail     account, cookie theft, etc. A remote attacker could exploit the IMAP     command injection to execute arbitrary IMAP commands on the configured     IMAP server.
  Workaround :

    There is no known workaround at this time.

The installed version of SquirrelMail fails to sanitize user-supplied input to mailbox names before passing them to an IMAP server.  An unauthenticated attacker may be able to leverage this issue to launch attacks against the underlying IMAP server or against a user's mailboxes by tricking him into clicking on a specially-formatted link in an email message.  There are also reportedly several possible cross-site scripting flaws that could be exploited to inject arbitrary HTML and script code into a user's browser.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
20998	Fedora Core 4 : squirrelmail-1.4.6-1.fc4 (2006-133)	Nessus	Fedora Local Security Checks	2006/3/6	2021/1/11	medium
21495	FreeBSD : squirrelmail -- multiple vulnerabilities (af9018b6-a4f5-11da-bb41-0011433a9404)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	medium
21992	CentOS 3 / 4 : squirrelmail (CESA-2006:0283)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	medium
22854	Debian DSA-988-1 : squirrelmail - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
20970	SquirrelMail < 1.4.6の複数の脆弱性	Nessus	CGI abuses	2006/2/22	2022/4/11	medium
20970	SquirrelMail < 1.4.6 多個弱點	Nessus	CGI abuses	2006/2/22	2022/4/11	medium
21363	RHEL 3 / 4 : squirrelmail (RHSA-2006:0283)	Nessus	Red Hat Local Security Checks	2006/5/13	2021/1/14	medium
20970	SquirrelMail < 1.4.6 Multiple Vulnerabilities	Nessus	CGI abuses	2006/2/22	2022/4/11	medium
21047	GLSA-200603-09 : SquirrelMail: XSS and IMAP command injection	Nessus	Gentoo Local Security Checks	2006/3/13	2021/1/6	medium
3441	SquirrelMail < 1.4.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2006/2/21	2019/3/6	medium

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium