ID de Prueba:	1.3.6.1.4.1.25623.1.0.16228
Categoría:	Web application abuses
Título:	SquirrelMail < 1.4.4 XSS Vulnerabilities
Resumen:	The target is running at least one instance of SquirrelMail whose; version number suggests it is vulnerable to one or more cross-site; scripting vulnerabilities :;; - Insufficient escaping of integer variables in webmail.php allows a; remote attacker to include HTML / script into a SquirrelMail webpage; (affects 1.4.0-RC1 - 1.4.4-RC1).;; - Insufficient checking of incoming URL vars in webmail.php allows an; attacker to include arbitrary remote web pages in the SquirrelMail; frameset (affects 1.4.0-RC1 - 1.4.4-RC1).;; - A recent change in prefs.php allows an attacker to provide a; specially crafted URL that could include local code into the; SquirrelMail code if and only if PHP's register_globals setting is; enabled (affects 1.4.3-RC1 - 1.4.4-RC1).
Descripción:	Summary: The target is running at least one instance of SquirrelMail whose version number suggests it is vulnerable to one or more cross-site scripting vulnerabilities : - Insufficient escaping of integer variables in webmail.php allows a remote attacker to include HTML / script into a SquirrelMail webpage (affects 1.4.0-RC1 - 1.4.4-RC1). - Insufficient checking of incoming URL vars in webmail.php allows an attacker to include arbitrary remote web pages in the SquirrelMail frameset (affects 1.4.0-RC1 - 1.4.4-RC1). - A recent change in prefs.php allows an attacker to provide a specially crafted URL that could include local code into the SquirrelMail code if and only if PHP's register_globals setting is enabled (affects 1.4.3-RC1 - 1.4.4-RC1). Solution: Upgrade to SquirrelMail 1.4.4 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2005-0075 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html Bugtraq: 20050129 SquirrelMail Security Advisory (Google Search) http://marc.info/?l=bugtraq&m=110702772714662&w=2 http://www.gentoo.org/security/en/glsa/glsa-200501-39.xml https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9587 http://www.redhat.com/support/errata/RHSA-2005-099.html http://www.redhat.com/support/errata/RHSA-2005-135.html http://secunia.com/advisories/13962/ Common Vulnerability Exposure (CVE) ID: CVE-2005-0103 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10670 XForce ISS Database: squirrelmail-frame-file-include(19037) https://exchange.xforce.ibmcloud.com/vulnerabilities/19037 Common Vulnerability Exposure (CVE) ID: CVE-2005-0104 Debian Security Information: DSA-662 (Google Search) http://www.debian.org/security/2005/dsa-662 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10568 http://secunia.com/advisories/14096 XForce ISS Database: squirrelmail-webmailphp-xss(19036) https://exchange.xforce.ibmcloud.com/vulnerabilities/19036
Copyright	Copyright (C) 2005 George A. Theall

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.