First published: Sat Jan 29 2005(Updated: )
prefs.php in SquirrelMail before 1.4.4, with register_globals enabled, allows remote attackers to inject local code into the SquirrelMail code via custom preference handlers.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
SquirrelMail | =1.4.2 | |
SquirrelMail | =1.0.5 | |
SquirrelMail | =1.2.7 | |
SquirrelMail | =1.2.0 | |
SquirrelMail | =1.2.9 | |
SquirrelMail | =1.2.2 | |
SquirrelMail | =1.4.3 | |
SquirrelMail | =1.2.1 | |
SquirrelMail | =1.4.1 | |
SquirrelMail | =1.4.0 | |
SquirrelMail | =1.4 | |
SquirrelMail | =1.2.4 | |
SquirrelMail | =1.2.3 | |
SquirrelMail | =1.4.3a | |
SquirrelMail | =1.0.4 | |
SquirrelMail | =1.2.6 | |
SquirrelMail | =1.2.10 | |
SquirrelMail | =1.2.5 | |
SquirrelMail | =1.2.8 | |
SquirrelMail | =1.2.11 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2005-0075 is considered to have a medium severity due to the potential for local code execution in vulnerable SquirrelMail installations.
To fix CVE-2005-0075, upgrade SquirrelMail to version 1.4.4 or later and ensure that register_globals is disabled in your PHP configuration.
CVE-2005-0075 affects SquirrelMail versions prior to 1.4.4, including 1.4.0 through 1.4.3, and 1.0.4 through 1.4.2.
Yes, CVE-2005-0075 can be exploited remotely by attackers to inject malicious code if the vulnerable versions of SquirrelMail have register_globals enabled.
The impacts of CVE-2005-0075 include unauthorized code execution which can lead to data compromise or server control.