CVE-2009-1381

Severity

68%

Complexity

86%

Confidentiality

106%

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

Type

SquirrelMail

First reported 15 years ago

2009-05-22 20:30:00

Last updated 6 years ago

2018-10-10 19:36:00

Affected Software

SquirrelMail 1.2.5

1.2.5

SquirrelMail 1.2.6

1.2.6

SquirrelMail 1.2.7

1.2.7

SquirrelMail 1.2.8

1.2.8

SquirrelMail 1.2.9

1.2.9

SquirrelMail 1.2.10

1.2.10

SquirrelMail 1.2.11

1.2.11

SquirrelMail 1.4.0

1.4.0

SquirrelMail 1.4.1

1.4.1

SquirrelMail 1.4.2

1.4.2

References

http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff

Exploit, Vendor Advisory

35140

Vendor Advisory

DSA-1802

Vendor Advisory

MDVSA-2009:122

20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix

FEDORA-2009-5471

FEDORA-2009-5350

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.