Test ID:	1.3.6.1.4.1.25623.1.0.57298
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1154)
Summary:	The remote host is missing an update for the Debian 'squirrelmail' package(s) announced via the DSA-1154 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'squirrelmail' package(s) announced via the DSA-1154 advisory. Vulnerability Insight: James Bercegay of GulfTech Security Research discovered a vulnerability in SquirrelMail where an authenticated user could overwrite random variables in the compose script. This might be exploited to read or write the preferences or attachment files of other users. For the stable distribution (sarge) this problem has been fixed in version 1.4.4-9. For the unstable distribution (sid) this problem has been fixed in version 1.4.8-1. We recommend that you upgrade your squirrelmail package. Affected Software/OS: 'squirrelmail' package(s) on Debian 3.1. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2006-4019 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html BugTraq ID: 19486 http://www.securityfocus.com/bid/19486 BugTraq ID: 25159 http://www.securityfocus.com/bid/25159 Bugtraq: 20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack (Google Search) http://www.securityfocus.com/archive/1/442993/100/0/threaded Bugtraq: 20060811 rPSA-2006-0152-1 squirrelmail (Google Search) http://www.securityfocus.com/archive/1/442980/100/0/threaded Debian Security Information: DSA-1154 (Google Search) http://www.debian.org/security/2006/dsa-1154 http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch http://www.osvdb.org/27917 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533 http://www.redhat.com/support/errata/RHSA-2006-0668.html http://securitytracker.com/id?1016689 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http://secunia.com/advisories/22080 http://secunia.com/advisories/22104 http://secunia.com/advisories/22487 http://secunia.com/advisories/26235 SGI Security Advisory: 20061001-01-P ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc SuSE Security Announcement: SUSE-SR:2006:023 (Google Search) http://www.novell.com/linux/security/advisories/2006_23_sr.html http://attrition.org/pipermail/vim/2006-August/000970.html http://www.vupen.com/english/advisories/2006/3271 http://www.vupen.com/english/advisories/2007/2732 XForce ISS Database: squirrelmail-compose-variable-overwrite(28365) https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.