ID de Prueba:	1.3.6.1.4.1.25623.1.0.57058
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2006:0547
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2006:0547. SquirrelMail is a standards-based webmail package written in PHP4. A local file disclosure flaw was found in the way SquirrelMail loads plugins. In SquirrelMail 1.4.6 or earlier, if register_globals is on and magic_quotes_gpc is off, it became possible for an unauthenticated remote user to view the contents of arbitrary local files the web server has read-access to. This configuration is neither default nor safe, and configuring PHP with the register_globals set on is dangerous and not recommended. (CVE-2006-2842) Users of SquirrelMail should upgrade to this erratum package, which contains a backported patch to correct this issue. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2006-0547.html http://www.squirrelmail.org/security/issue/2006-06-01 http://www.php.net/register_globals http://www.redhat.com/security/updates/classification/#moderate Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2006-2842 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html BugTraq ID: 18231 http://www.securityfocus.com/bid/18231 BugTraq ID: 25159 http://www.securityfocus.com/bid/25159 Bugtraq: 20060601 Squirrelmail local file inclusion (Google Search) http://www.securityfocus.com/archive/1/435605/100/0/threaded http://www.mandriva.com/security/advisories?name=MDKSA-2006:101 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11670 http://www.redhat.com/support/errata/RHSA-2006-0547.html http://securitytracker.com/id?1016209 http://secunia.com/advisories/20406 http://secunia.com/advisories/20931 http://secunia.com/advisories/21159 http://secunia.com/advisories/21262 http://secunia.com/advisories/26235 SGI Security Advisory: 20060703-01-P ftp://patches.sgi.com/support/free/security/advisories/20060703-01-U.asc SuSE Security Announcement: SUSE-SR:2006:017 (Google Search) http://www.novell.com/linux/security/advisories/2006_17_sr.html http://www.vupen.com/english/advisories/2006/2101 http://www.vupen.com/english/advisories/2007/2732
Copyright	Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.