Sponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||||
Red Hat alert RHSA-2005:135-01 (Squirrelmail)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Updated Squirrelmail package fixes security issues Advisory ID: RHSA-2005:135-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-135.html Issue date: 2005-02-10 Updated on: 2005-02-10 Product: Red Hat Enterprise Linux CVE Names: CAN-2005-0075 CAN-2005-0103 CAN-2005-0104 - --------------------------------------------------------------------- 1. Summary: An updated Squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 3. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - noarch Red Hat Desktop version 3 - noarch Red Hat Enterprise Linux ES version 3 - noarch Red Hat Enterprise Linux WS version 3 - noarch 3. Problem description: SquirrelMail is a standards-based webmail package written in PHP4. Jimmy Conner discovered a missing variable initialization in Squirrelmail. This flaw could allow potential insecure file inclusions on servers where the PHP setting "register_globals" is set to "On". This is not a default or recommended setting. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0075 to this issue. A URL sanitisation bug was found in Squirrelmail. This flaw could allow a cross site scripting attack when loading the URL for the sidebar. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0103 to this issue. A missing variable initialization bug was found in Squirrelmail. This flaw could allow a cross site scripting attack. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0104 to this issue. Users of Squirrelmail are advised to upgrade to this updated package, which contains backported patches to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/): 145384 - CAN-2005-0075 Arbitrary code injection in Squirrelmail 145964 - CAN-2005-0103 Multiple issues in squirrelmail (CAN-2005-0104) 6. RPMs required: Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/squir... 02b0f904180ad4dabaa93721641a3efa squirrelmail-1.4.3a-9.EL3.src.rpm noarch: 2e22c82b0b1986cad90a8fe38cd44845 squirrelmail-1.4.3a-9.EL3.noarch.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/... 02b0f904180ad4dabaa93721641a3efa squirrelmail-1.4.3a-9.EL3.src.rpm noarch: 2e22c82b0b1986cad90a8fe38cd44845 squirrelmail-1.4.3a-9.EL3.noarch.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/squir... 02b0f904180ad4dabaa93721641a3efa squirrelmail-1.4.3a-9.EL3.src.rpm noarch: 2e22c82b0b1986cad90a8fe38cd44845 squirrelmail-1.4.3a-9.EL3.noarch.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/squir... 02b0f904180ad4dabaa93721641a3efa squirrelmail-1.4.3a-9.EL3.src.rpm noarch: 2e22c82b0b1986cad90a8fe38cd44845 squirrelmail-1.4.3a-9.EL3.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://www.squirrelmail.org/security/issue/2005-01-20 http://www.squirrelmail.org/security/issue/2005-01-19 http://www.squirrelmail.org/security/issue/2005-01-14 http://www.php.net/register_globals http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0075 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0104 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQFCC5Y3XlSAg2UNWIIRAp87AKDBioH/Ff/SlsM+PG23yhLz4g+6TQCghbnN TKetTdzqcj9K4xPrwtxCLkQ= =RjEw -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list Enterprise-watch-list@redhat.com https://www.redhat.com/mailman/listinfo/enterprise-watch-... (Log in to post comments)
|
|||||||||||||