Test Kennung:	1.3.6.1.4.1.25623.1.0.51654
Kategorie:	Red Hat Local Security Checks
Titel:	RedHat Security Advisory RHSA-2005:099
Zusammenfassung:	Redhat Security Advisory RHSA-2005:099
Beschreibung:	The remote host is missing updates announced in advisory RHSA-2005:099. SquirrelMail is a standards-based webmail package written in PHP4. Jimmy Conner discovered a missing variable initialization in Squirrelmail. This flaw could allow potential insecure file inclusions on servers where the PHP setting register_globals is set to On. This is not a default or recommended setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0075 to this issue. A URL sanitisation bug was found in Squirrelmail. This flaw could allow a cross site scripting attack when loading the URL for the sidebar. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0103 to this issue. A missing variable initialization bug was found in Squirrelmail. This flaw could allow a cross site scripting attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0104 to this issue. Users of Squirrelmail are advised to upgrade to this updated package, which contains backported patches to correct these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2005-099.html http://www.squirrelmail.org/security/issue/2005-01-20 http://www.squirrelmail.org/security/issue/2005-01-19 http://www.squirrelmail.org/security/issue/2005-01-14 http://www.php.net/register_globals Risk factor : High
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2005-0075 Bugtraq: 20050129 SquirrelMail Security Advisory (Google Search) http://marc.theaimsgroup.com/?l=bugtraq&m=110702772714662&w=2 http://lists.apple.com/archives/security-announce/2005/Mar/msg00000.html http://www.gentoo.org/security/en/glsa/glsa-200501-39.xml http://www.redhat.com/support/errata/RHSA-2005-099.html http://www.redhat.com/support/errata/RHSA-2005-135.html http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9587 http://secunia.com/advisories/13962/ Common Vulnerability Exposure (CVE) ID: CVE-2005-0103 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10670 XForce ISS Database: squirrelmail-frame-file-include(19037) http://xforce.iss.net/xforce/xfdb/19037 Common Vulnerability Exposure (CVE) ID: CVE-2005-0104 Debian Security Information: DSA-662 (Google Search) http://www.debian.org/security/2005/dsa-662 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10568 http://secunia.com/advisories/14096 XForce ISS Database: squirrelmail-webmailphp-xss(19036) http://xforce.iss.net/xforce/xfdb/19036
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 32582 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.

Registrierung eines neuen Benutzers Email: Benutzerkennung: Passwort: Bitte schicken Sie mir den monatlichen Newsletter, der mich über die neuesten Services, Verbesserungen und Umfragen informiert. Bitte schicken Sie mir eine Anfälligkeitstest Benachrichtigung, wenn ein neuer Test hinzugefügt wird.     Datenschutz

Anmeldung für registrierte Benutzer   Benutzerkennung:     Passwort:     Benutzerkennung oder Passwort vergessen? Email/Benutzerkennung: