Test ID:	1.3.6.1.4.1.25623.1.0.57285
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2006:147 (squirrelmail)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to squirrelmail announced via advisory MDKSA-2006:147. Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail 1.5.1 and earlier, when register_globals is enabled, allows remote attackers to inject arbitrary HTML via the mailbox parameter (CVE-2006-3174). NOTE: The squirrelmail developers dispute this issue, but the relevant code has been reworked to be sure. The patch has been applied to the Mandriva packages. Dynamic variable evaluation vulnerability in compose.php in SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite arbitrary program variables and read or write the attachments and references of other users (CVE-2006-4019). Updated packages are patched to address these issues. Affected: Corporate 3.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2006:147 Risk factor : High CVSS Score: 6.4
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-3174 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html BugTraq ID: 18700 http://www.securityfocus.com/bid/18700 BugTraq ID: 25159 http://www.securityfocus.com/bid/25159 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://pridels0.blogspot.com/2006/06/squirrelmail-151-xss-vuln.html http://www.osvdb.org/26610 http://secunia.com/advisories/26235 http://www.vupen.com/english/advisories/2007/2732 XForce ISS Database: squirrelmail-search-xss(26941) https://exchange.xforce.ibmcloud.com/vulnerabilities/26941 Common Vulnerability Exposure (CVE) ID: CVE-2006-4019 BugTraq ID: 19486 http://www.securityfocus.com/bid/19486 Bugtraq: 20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack (Google Search) http://www.securityfocus.com/archive/1/442993/100/0/threaded Bugtraq: 20060811 rPSA-2006-0152-1 squirrelmail (Google Search) http://www.securityfocus.com/archive/1/442980/100/0/threaded Debian Security Information: DSA-1154 (Google Search) http://www.debian.org/security/2006/dsa-1154 http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch http://www.osvdb.org/27917 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533 http://www.redhat.com/support/errata/RHSA-2006-0668.html http://securitytracker.com/id?1016689 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http://secunia.com/advisories/22080 http://secunia.com/advisories/22104 http://secunia.com/advisories/22487 SGI Security Advisory: 20061001-01-P ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc SuSE Security Announcement: SUSE-SR:2006:023 (Google Search) http://www.novell.com/linux/security/advisories/2006_23_sr.html http://attrition.org/pipermail/vim/2006-August/000970.html http://www.vupen.com/english/advisories/2006/3271 XForce ISS Database: squirrelmail-compose-variable-overwrite(28365) https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
Copyright	Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.