CVE-2007-3778: High severity Squirrelmail GPG Plugin vulnerability

Published Jul 15, 2007

Updated

The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpgchecksignpgpmime function in gpghookfunctions.php. NOTE: a parameter value can be set in the contents of an e-mail message.

Affected Software

2 affected components

Squirrelmail GPG Plugin=2.1_dev

Squirrelmail GPG Plugin=2.0

Remediation

Patch Available

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330

Event History

Jul 15, 2007

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3778?

CVE-2007-3778 is considered a critical vulnerability due to the potential for remote code execution.

How do I fix CVE-2007-3778?

To fix CVE-2007-3778, upgrade the GPG Plugin to version 2.1dev or later, ensuring it's patched against this vulnerability.

Who is affected by CVE-2007-3778?

CVE-2007-3778 affects users of SquirrelMail GPG Plugin versions 2.0 and 2.1dev prior to September 12, 2006.

What are the consequences of exploiting CVE-2007-3778?

Exploiting CVE-2007-3778 allows remote attackers to execute arbitrary commands on the server.

What components are involved in CVE-2007-3778?

CVE-2007-3778 involves the gpg_check_sign_pgp_mime function in the gpg_hook_functions.php file.