CVE-2006-4169: Medium severity Squirrelmail GPG Plugin vulnerability
Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin 2.0, and 2.1dev before 20070614, for Squirrelmail allow remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the help parameter to (1) gpghelp.php or (2) gpghelpbase.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4169?
CVE-2006-4169 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2006-4169?
To fix CVE-2006-4169, update the GPG Plugin for SquirrelMail to version 2.1dev or later released after June 14, 2007.
Who is affected by CVE-2006-4169?
CVE-2006-4169 affects users of the GPG Plugin versions 2.0 and 2.1dev of SquirrelMail.
What type of attack does CVE-2006-4169 enable?
CVE-2006-4169 enables authenticated remote users to execute arbitrary local files on the server.
How can I determine if I am using a vulnerable version of GPG Plugin according to CVE-2006-4169?
You can determine if you are using a vulnerable version of GPG Plugin by checking your installation against the versions 2.0 or 2.1dev prior to the patch date of June 14, 2007.