Test ID:	1.3.6.1.4.1.25623.1.0.106785
Category:	Web application abuses
Title:	SquirrelMail < 1.4.23 Multiple Vulnerabilities
Summary:	SquirrelMail is prone to authenticated remote code execution; (RCE) and directory traversal vulnerabilities.
Description:	Summary: SquirrelMail is prone to authenticated remote code execution (RCE) and directory traversal vulnerabilities. Vulnerability Insight: SquirrelMail allows: - post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. - uploading a mail attachment a temporary file is generated on the server that the client later references when sending the mail. The filename is not sanitized in any way, so by passing a filename of the form '../../../../some_path/some_filename' one can use this to attach arbitrary files from the server that can be accessed by the PHP process to a mail. Vulnerability Impact: An authenticated attacker may execute arbitrary shell commands or read files from the filesystem. Affected Software/OS: SquirrelMail 1.4.22 and prior as well as the trunk version (before r14650). Solution: Source-Code patches for both issues are available in the linked references. CVSS Score: 9.0 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2017-7692 BugTraq ID: 98067 http://www.securityfocus.com/bid/98067 Debian Security Information: DSA-3852 (Google Search) http://www.debian.org/security/2017/dsa-3852 https://www.exploit-db.com/exploits/41910/ https://security.gentoo.org/glsa/201709-13 http://openwall.com/lists/oss-security/2017/04/19/6 http://openwall.com/lists/oss-security/2017/04/27/1 https://legalhackers.com/advisories/SquirrelMail-Exploit-Remote-Code-Exec-CVE-2017-7692-Vuln.html http://www.securitytracker.com/id/1038312 Common Vulnerability Exposure (CVE) ID: CVE-2018-8741 Debian Security Information: DSA-4168 (Google Search) https://www.debian.org/security/2018/dsa-4168 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T5FP5O562A4FM5TCFNEW73SS6PZONSAC/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/ http://www.openwall.com/lists/oss-security/2018/03/17/2 https://gist.github.com/hannob/3c4f86863c418930ad08853c1109364e https://insinuator.net/2018/03/squirrelmail-full-disclosure-troopers18/ https://paste.pound-python.org/show/OjSLiFTxiBrTk63jqEUu/ https://lists.debian.org/debian-lts-announce/2018/04/msg00012.html http://www.securitytracker.com/id/1040554
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.