Inicial ▼ Bookkeeping
Online ▼ Auditorias ▼
DNS
Administrado ▼
Acerca de DNS
Ordenar/Renovar
Preguntas Frecuentes
AUP
Dynamic DNS Clients
Configurar Dominios Dynamic DNS Update Password Monitoreo
de Redes ▼
Enterprise
Avanzado
Estándarr
Prueba
Preguntas Frecuentes
Resumen de Precio/Funciones
Ordenar
Muestras
Configure/Status Alert Profiles | |||
ID de Prueba: | 1.3.6.1.4.1.25623.1.0.900713 |
Categoría: | Web application abuses |
Título: | SquirrelMail Command Execution Vulnerability |
Resumen: | This host is running SquirrelMail Web application and is prone; to command execution vulnerability. |
Descripción: | Summary: This host is running SquirrelMail Web application and is prone to command execution vulnerability. Vulnerability Insight: The flaw is due to improper handling of arbitrary commands in map_yp_alias function in functions/imap_general.php file via shell metacharacters in a username string that is used by the ypmatch program. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary commands into the context of the affected web mailing application and can conduct cross site scripting, session fixation or phishing attacks. Affected Software/OS: SquirrelMail version prior to 1.4.19. Solution: Upgrade to SquirrelMail version 1.4.19 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P |
Referencia Cruzada: |
BugTraq ID: 34916 Common Vulnerability Exposure (CVE) ID: CVE-2009-1381 Bugtraq: 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix (Google Search) http://www.securityfocus.com/archive/1/503718/100/0/threaded Debian Security Information: DSA-1802 (Google Search) http://www.debian.org/security/2009/dsa-1802 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:122 http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff http://secunia.com/advisories/35140 |
Copyright | Copyright (C) 2009 Greenbone Networks GmbH |
Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora. |