ID de Prueba:	1.3.6.1.4.1.25623.1.0.900713
Categoría:	Web application abuses
Título:	SquirrelMail Command Execution Vulnerability
Resumen:	SquirrelMail Web application is prone to a command execution vulnerability.
Descripción:	Summary: SquirrelMail Web application is prone to a command execution vulnerability. Vulnerability Insight: The flaw is due to improper handling of arbitrary commands in map_yp_alias function in functions/imap_general.php file via shell metacharacters in a username string that is used by the ypmatch program. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary commands into the context of the affected web mailing application and can conduct cross site scripting, session fixation or phishing attacks. Affected Software/OS: SquirrelMail version prior to 1.4.19. Solution: Upgrade to SquirrelMail version 1.4.19 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1381 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix http://www.securityfocus.com/archive/1/503718/100/0/threaded 35140 http://secunia.com/advisories/35140 DSA-1802 http://www.debian.org/security/2009/dsa-1802 FEDORA-2009-5350 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html FEDORA-2009-5471 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html MDVSA-2009:122 http://www.mandriva.com/security/advisories?name=MDVSA-2009:122 http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff
Copyright	Copyright (C) 2009 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.