CVE-2009-2964: CSRF
It was reported that SquirrelMail did not implement protections against cross-site request forgery (CSRF) attacks. This can be exploited to e.g. change user preferences, delete emails, and potentially send emails when a logged-in user visits a malicious web page.
Upstream advisory: http://www.squirrelmail.org/security/issue/2009-08-12
Upstream patch: http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
Issue was first addressed in 1.4.20RC1.
Secunia advisory: http://secunia.com/advisories/34627/
Other sources
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailboxdisplay.php, (2) src/addrbooksearchhtml.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folderscreate.php, (7) src/foldersdelete.php, (8) src/foldersrenamedo.php, (9) src/foldersrenamegetname.php, (10) src/folderssubscribe.php, (11) src/movemessages.php, (12) src/options.php, (13) src/optionshighlight.php, (14) src/optionsidentities.php, (15) src/optionsorder.php, (16) src/search.php, and (17) src/vcard.php.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2964?
CVE-2009-2964 is classified as a moderate severity vulnerability due to potential exploitation that can hijack user authentication.
How do I fix CVE-2009-2964?
To fix CVE-2009-2964, update SquirrelMail to version 1.4.20 or later.
Which versions are affected by CVE-2009-2964?
CVE-2009-2964 affects SquirrelMail versions 1.4.19 and earlier.
What type of vulnerability is CVE-2009-2964?
CVE-2009-2964 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can CVE-2009-2964 lead to account takeover?
Yes, CVE-2009-2964 can allow attackers to hijack user sessions and perform unauthorized actions.