Rapid7 Vulnerability & Exploit Database

RHSA-2007:0022: squirrelmail security update

Back to Search

RHSA-2007:0022: squirrelmail security update

Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
12/05/2006
Created
07/25/2018
Added
02/23/2007
Modified
07/12/2017

Description

A new squirrelmail package that fixes security issues is now available for Red Hat Enterprise Linux 3 and 4.

SquirrelMail is a standards-based webmail package written in PHP. Several cross-site scripting bugs were discovered in SquirrelMail. An attacker could inject arbitrary Javascript or HTML content into SquirrelMail pages by tricking a user into visiting a carefully crafted URL. (CVE-2006-6142) Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct these issues. Notes: - After installing this update, users are advised to restart their httpd service to ensure that the updated version functions correctly. - config.php should NOT be modified, please modify config_local.php instead. - Known Bug: The configuration generator may potentially produce bad options that interfere with the operation of this application. Applying specific config changes to config_local.php manually is recommended.

Solution(s)

  • redhat-upgrade-squirrelmail

References

  • redhat-upgrade-squirrelmail

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;