Test ID:	1.3.6.1.4.1.25623.1.0.900713
Category:	Web application abuses
Title:	SquirrelMail Command Execution Vulnerability
Summary:	SquirrelMail Web application is prone to a command execution vulnerability.
Description:	Summary: SquirrelMail Web application is prone to a command execution vulnerability. Vulnerability Insight: The flaw is due to improper handling of arbitrary commands in map_yp_alias function in functions/imap_general.php file via shell metacharacters in a username string that is used by the ypmatch program. Vulnerability Impact: Successful exploitation will let the attacker execute arbitrary commands into the context of the affected web mailing application and can conduct cross site scripting, session fixation or phishing attacks. Affected Software/OS: SquirrelMail version prior to 1.4.19. Solution: Upgrade to SquirrelMail version 1.4.19 or later. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1381 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix http://www.securityfocus.com/archive/1/503718/100/0/threaded 35140 http://secunia.com/advisories/35140 DSA-1802 http://www.debian.org/security/2009/dsa-1802 FEDORA-2009-5350 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01202.html FEDORA-2009-5471 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01195.html MDVSA-2009:122 http://www.mandriva.com/security/advisories?name=MDVSA-2009:122 http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.