ID de Prueba:	1.3.6.1.4.1.25623.1.0.900713
Categoría:	Web application abuses
Título:	SquirrelMail Command Execution Vulnerability
Resumen:	This host is running SquirrelMail Web application and is prone; to command execution vulnerability.
Descripción:	Summary: This host is running SquirrelMail Web application and is prone to command execution vulnerability. Vulnerability Insight: The flaw is due to improper handling of arbitrary commands in map_yp_alias function in functions/imap_general.php file via shell metacharacters in a username string that is used by the ypmatch program. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary commands into the context of the affected web mailing application and can conduct cross site scripting, session fixation or phishing attacks. Affected Software/OS: SquirrelMail version prior to 1.4.19. Solution: Upgrade to SquirrelMail version 1.4.19 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	BugTraq ID: 34916 Common Vulnerability Exposure (CVE) ID: CVE-2009-1381 Bugtraq: 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix (Google Search) http://www.securityfocus.com/archive/1/503718/100/0/threaded Debian Security Information: DSA-1802 (Google Search) http://www.debian.org/security/2009/dsa-1802 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:122 http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff http://secunia.com/advisories/35140
Copyright	Copyright (C) 2009 Greenbone Networks GmbH

Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.