CVE-2009-1381: OS Command Injection
It was discovered that original upstream patch for server-side command execution flaw affecting setups with mapypalias username map enabled did not address the issue completely, due to incorrect use of quoting (backticks vs. single quotes). Code execution was still possible in upstream version 1.4.18.
Issue was fixed upstream in 1.4.19.
Updated upstream security advisory: http://www.squirrelmail.org/security/issue/2009-05-10
Full upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733
Other sources
The mapypalias function in functions/imapgeneral.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1381?
The severity of CVE-2009-1381 is rated as high due to its potential for server-side command execution.
How do I fix CVE-2009-1381?
To fix CVE-2009-1381, ensure that you apply the latest patches provided by the SquirrelMail project for the affected versions.
Which versions of SquirrelMail are affected by CVE-2009-1381?
CVE-2009-1381 affects SquirrelMail versions 1.2.2 to 1.4.1.
Can I safely use SquirrelMail version 1.4.2 or later regarding CVE-2009-1381?
Yes, SquirrelMail versions 1.4.2 and later are not affected by CVE-2009-1381.
What types of systems are at risk due to CVE-2009-1381?
Systems with SquirrelMail configurations using the map_yp_alias username map enabled are at risk due to CVE-2009-1381.