CVE-2009-1579: Code Injection
From SquirrelMail vulnerability report:
An issue was fixed that allowed arbitrary server-side code execution when SquirrelMail was configured to use the example "mapypalias" username mapping functionality.
Credits: Niels Teusink
Updated upstream patch (2009-05-21): http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?r1=13549&r2=13733&view=patch
Other sources
The mapypalias function in functions/imapgeneral.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1579?
CVE-2009-1579 is considered a high severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2009-1579?
To fix CVE-2009-1579, upgrade SquirrelMail to version 1.4.18 or later.
What systems are affected by CVE-2009-1579?
CVE-2009-1579 affects SquirrelMail versions prior to 1.4.18 and NaSMail versions prior to 1.7.
Can CVE-2009-1579 be exploited remotely?
Yes, CVE-2009-1579 can be exploited remotely through crafted username strings containing shell metacharacters.
What type of vulnerability is CVE-2009-1579 classified as?
CVE-2009-1579 is classified as a remote code execution vulnerability.