CVE-2005-1924: Critical severity Squirrelmail GPG Plugin vulnerability
The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpgkeyring.php, as called by (a) importkeyfile.php, (b) importkeytext.php, and (c) keyringmain.php; and (2) the keyserver parameter to the gpgrecvkey function in gpgkeyfunctions.php, as called by gpgoptions.php. NOTE: this issue may overlap CVE-2007-3636.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-1924?
CVE-2005-1924 has a medium severity rating due to its potential for remote command execution.
How do I fix CVE-2005-1924?
To fix CVE-2005-1924, upgrade the SquirrelMail GPG Plugin to a version later than 2.1.
Which versions are affected by CVE-2005-1924?
CVE-2005-1924 affects SquirrelMail GPG Plugin versions 2.1 and earlier.
What kind of attacks can exploit CVE-2005-1924?
CVE-2005-1924 can be exploited by remote authenticated users to execute arbitrary commands.
What is the impact of CVE-2005-1924 on systems?
The impact of CVE-2005-1924 includes unauthorized command execution, which can compromise system integrity and security.