Test ID:	1.3.6.1.4.1.25623.1.0.70227
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2291-1)
Summary:	The remote host is missing an update for the Debian 'squirrelmail' package(s) announced via the DSA-2291-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'squirrelmail' package(s) announced via the DSA-2291-1 advisory. Vulnerability Insight: Various vulnerabilities have been found in SquirrelMail, a webmail application. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2010-4554 SquirrelMail did not prevent page rendering inside a third-party HTML frame, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site. CVE-2010-4555, CVE-2011-2752, CVE-2011-2753 Multiple small bugs in SquirrelMail allowed an attacker to inject malicious script into various pages or alter the contents of user preferences. CVE-2011-2023 It was possible to inject arbitrary web script or HTML via a crafted STYLE element in an HTML part of an e-mail message. For the oldstable distribution (lenny), these problems have been fixed in version 1.4.15-4+lenny5. For the stable distribution (squeeze), these problems have been fixed in version 1.4.21-2. For the testing (wheezy) and unstable distribution (sid), these problems have been fixed in version 1.4.22-1. We recommend that you upgrade your squirrelmail packages. Affected Software/OS: 'squirrelmail' package(s) on Debian 5, Debian 6. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-4554 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html Debian Security Information: DSA-2291 (Google Search) http://www.debian.org/security/2011/dsa-2291 http://www.mandriva.com/security/advisories?name=MDVSA-2011:123 RedHat Security Advisories: RHSA-2012:0103 http://rhn.redhat.com/errata/RHSA-2012-0103.html XForce ISS Database: squirrelmail-http-clickjacking(68512) https://exchange.xforce.ibmcloud.com/vulnerabilities/68512 Common Vulnerability Exposure (CVE) ID: CVE-2010-4555 XForce ISS Database: squirrelmail-dropdown-xss(68510) https://exchange.xforce.ibmcloud.com/vulnerabilities/68510 XForce ISS Database: squirrelmail-spellchecking-xss(68511) https://exchange.xforce.ibmcloud.com/vulnerabilities/68511 Common Vulnerability Exposure (CVE) ID: CVE-2011-2023 http://securitytracker.com/id?1025766 Common Vulnerability Exposure (CVE) ID: CVE-2011-2752 XForce ISS Database: squirrelmail-newline-crlf-injection(68587) https://exchange.xforce.ibmcloud.com/vulnerabilities/68587 Common Vulnerability Exposure (CVE) ID: CVE-2011-2753 XForce ISS Database: squirrelmail-authentication-csrf(68586) https://exchange.xforce.ibmcloud.com/vulnerabilities/68586
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.