Issued:
2007-01-31
Updated:
2007-01-31

RHSA-2007:0022 - Security Advisory

Synopsis

Moderate: squirrelmail security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

A new squirrelmail package that fixes security issues is now available for
Red Hat Enterprise Linux 3 and 4.

Description

SquirrelMail is a standards-based webmail package written in PHP.

Several cross-site scripting bugs were discovered in SquirrelMail. An
attacker could inject arbitrary Javascript or HTML content into
SquirrelMail pages by tricking a user into visiting a carefully crafted
URL. (CVE-2006-6142)

Users of SquirrelMail should upgrade to this erratum package, which
contains a backported patch to correct these issues.

Notes:

  • After installing this update, users are advised to restart their

httpd service to ensure that the updated version functions correctly.

  • config.php should NOT be modified, please modify config_local.php instead.
  • Known Bug: The configuration generator may potentially produce bad

options that interfere with the operation of this application. Applying
specific config changes to config_local.php manually is recommended.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 218294 - CVE-2006-6142 Three XSS issues in SquirrelMail

Red Hat Enterprise Linux Server 4

SRPM
squirrelmail-1.4.8-4.el4.src.rpm SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3
x86_64
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
ia64
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
i386
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
squirrelmail-1.4.8-4.el4.src.rpm SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3
x86_64
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
ia64
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
i386
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
squirrelmail-1.4.8-4.el4.src.rpm SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3
x86_64
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
i386
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
squirrelmail-1.4.8-4.el4.src.rpm SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3
s390x
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07
s390
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
squirrelmail-1.4.8-4.el4.src.rpm SHA-256: 02622375739453b208ed16bf0fae60c01bb25385e82fa6e2671fc455734e1de3
ppc
squirrelmail-1.4.8-4.el4.noarch.rpm SHA-256: 7c208f7ef2f8ef71ae221f3dfc3c6e0e49a12868402e5ea56a12aadd25660c07

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.