RHSA-2004:240 - Security Advisory

Topic

An updated SquirrelMail package that fixes several security vulnerabilities
is now available.

Description

SquirrelMail is a webmail package written in PHP. Multiple
vulnerabilities have been found which affect the version of SquirrelMail
shipped with Red Hat Enterprise Linux 3.

An SQL injection flaw was found in SquirrelMail version 1.4.2 and earlier.
If SquirrelMail is configured to store user addressbooks in the database, a
remote attacker could use this flaw to execute arbitrary SQL statements.
The Common Vulnerabilities and Exposures project has assigned the name
CAN-2004-0521 to this issue.

A number of cross-site scripting (XSS) flaws in SquirrelMail version 1.4.2
and earlier could allow remote attackers to execute script as other web
users. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CAN-2004-0519 and CAN-2004-0520 to these issues.

All users of SquirrelMail are advised to upgrade to the erratum package
containing SquirrelMail version 1.4.3a which is not vulnerable to these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 122512 - CAN-2004-0519/20/21 XSS and SQL issues in Squirrelmail

CVEs

• CVE-2004-0519
• CVE-2004-0520
• CVE-2004-0521

References

• http://marc.theaimsgroup.com/?l=squirrelmail-announce&m=108595407012256