ID de Prueba:	1.3.6.1.4.1.25623.1.0.57398
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2006:0668
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2006:0668. SquirrelMail is a standards-based webmail package written in PHP. A dynamic variable evaluation flaw was found in SquirrelMail. Users who have an account on a SquirrelMail server and are logged in could use this flaw to overwrite variables which may allow them to read or write other users' preferences or attachments. (CVE-2006-4019) Users of SquirrelMail should upgrade to this erratum package, which contains SquirrelMail 1.4.8 to correct this issue. This package also contains a number of additional patches to correct various bugs. Note: After installing this update, users are advised to restart their httpd service to ensure that the new version functions correctly. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2006-0668.html http://www.redhat.com/security/updates/classification/#moderate Risk factor : High CVSS Score: 6.4
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2006-4019 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html BugTraq ID: 19486 http://www.securityfocus.com/bid/19486 BugTraq ID: 25159 http://www.securityfocus.com/bid/25159 Bugtraq: 20060811 SquirrelMail 1.4.8 released - fixes variable overwriting attack (Google Search) http://www.securityfocus.com/archive/1/442993/100/0/threaded Bugtraq: 20060811 rPSA-2006-0152-1 squirrelmail (Google Search) http://www.securityfocus.com/archive/1/442980/100/0/threaded Debian Security Information: DSA-1154 (Google Search) http://www.debian.org/security/2006/dsa-1154 http://marc.info/?l=full-disclosure&m=115532449024178&w=2 http://www.mandriva.com/security/advisories?name=MDKSA-2006:147 http://www.squirrelmail.org/patches/sqm1.4.7-expired-post-fix-full.patch http://www.osvdb.org/27917 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11533 http://www.redhat.com/support/errata/RHSA-2006-0668.html http://securitytracker.com/id?1016689 http://secunia.com/advisories/21354 http://secunia.com/advisories/21444 http://secunia.com/advisories/21586 http://secunia.com/advisories/22080 http://secunia.com/advisories/22104 http://secunia.com/advisories/22487 http://secunia.com/advisories/26235 SGI Security Advisory: 20061001-01-P ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc SuSE Security Announcement: SUSE-SR:2006:023 (Google Search) http://www.novell.com/linux/security/advisories/2006_23_sr.html http://attrition.org/pipermail/vim/2006-August/000970.html http://www.vupen.com/english/advisories/2006/3271 http://www.vupen.com/english/advisories/2007/2732 XForce ISS Database: squirrelmail-compose-variable-overwrite(28365) https://exchange.xforce.ibmcloud.com/vulnerabilities/28365
Copyright	Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.