ID de Prueba:	1.3.6.1.4.1.25623.1.0.64063
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2009:1066
Resumen:	The remote host is missing updates announced in;advisory RHSA-2009:1066.;;A server-side code injection flaw was found in the SquirrelMail;map_yp_alias function. If SquirrelMail was configured to retrieve a;user's IMAP server address from a Network Information Service (NIS) server;via the map_yp_alias function, an unauthenticated, remote attacker using;a specially-crafted username could use this flaw to execute arbitrary code;with the privileges of the web server. (CVE-2009-1579);;Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. An;attacker could construct a carefully crafted URL, which once visited by an;unsuspecting user, could cause the user's web browser to execute malicious;script in the context of the visited SquirrelMail web page. (CVE-2009-1578);;It was discovered that SquirrelMail did not properly sanitize Cascading;Style Sheets (CSS) directives used in HTML mail. A remote attacker could;send a specially-crafted email that could place mail content above;SquirrelMail's controls, possibly allowing phishing and cross-site;scripting attacks. (CVE-2009-1581);;Users of squirrelmail should upgrade to this updated package, which;contains backported patches to correct these issues.
Descripción:	Summary: The remote host is missing updates announced in advisory RHSA-2009:1066. A server-side code injection flaw was found in the SquirrelMail map_yp_alias function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the map_yp_alias function, an unauthenticated, remote attacker using a specially-crafted username could use this flaw to execute arbitrary code with the privileges of the web server. (CVE-2009-1579) Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578) It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially-crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581) Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1578 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html BugTraq ID: 34916 http://www.securityfocus.com/bid/34916 Debian Security Information: DSA-1802 (Google Search) http://www.debian.org/security/2009/dsa-1802 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00566.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00572.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg00577.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:110 http://osvdb.org/60468 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11624 http://www.redhat.com/support/errata/RHSA-2009-1066.html http://secunia.com/advisories/35052 http://secunia.com/advisories/35073 http://secunia.com/advisories/35140 http://secunia.com/advisories/35259 http://secunia.com/advisories/37415 http://secunia.com/advisories/40220 http://www.vupen.com/english/advisories/2009/1296 http://www.vupen.com/english/advisories/2009/3315 http://www.vupen.com/english/advisories/2010/1481 XForce ISS Database: squirrelmail-decryptheaders-xss(50460) https://exchange.xforce.ibmcloud.com/vulnerabilities/50460 XForce ISS Database: squirrelmail-phpself-xss(50459) https://exchange.xforce.ibmcloud.com/vulnerabilities/50459 Common Vulnerability Exposure (CVE) ID: CVE-2009-1579 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10986 XForce ISS Database: squirrelmail-mapypalias-code-execution(50461) https://exchange.xforce.ibmcloud.com/vulnerabilities/50461 Common Vulnerability Exposure (CVE) ID: CVE-2009-1581 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10441 XForce ISS Database: squirrelmail-css-xss(50463) https://exchange.xforce.ibmcloud.com/vulnerabilities/50463
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.