CVE-2010-2813
First published: Mon Jul 26 2010(Updated: )
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username. References: [1] <a href="http://www.squirrelmail.org/security/issue/2010-07-23">http://www.squirrelmail.org/security/issue/2010-07-23</a> Upstream patch: [2] <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972</a> Affected Versions: <= v1.4.20 Register Globals: Register_globals does not have to be on for this issue. Credit: Issue discovered by Mikhail Goriachev
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Squirrelmail Squirrelmail | =1.4.2 | |
| Squirrelmail Squirrelmail | =1.4.5_rc1 | |
| Squirrelmail Squirrelmail | =1.4.17 | |
| Squirrelmail Squirrelmail | =1.4.6_rc1 | |
| Squirrelmail Squirrelmail | =1.4.19 | |
| Squirrelmail Squirrelmail | =1.4.3_r3 | |
| Squirrelmail Squirrelmail | =1.4.0-r1 | |
| Squirrelmail Squirrelmail | =1.4.13 | |
| Squirrelmail Squirrelmail | =1.4.12 | |
| Squirrelmail Squirrelmail | =1.4.9a | |
| Squirrelmail Squirrelmail | =1.4.6 | |
| Squirrelmail Squirrelmail | =1.4.3-r3 | |
| Squirrelmail Squirrelmail | =1.4.7 | |
| Squirrelmail Squirrelmail | =1.4.3_rc1 | |
| Squirrelmail Squirrelmail | =1.4.15 | |
| Squirrelmail Squirrelmail | =1.4.2-r3 | |
| Squirrelmail Squirrelmail | =1.4.4_rc1 | |
| Squirrelmail Squirrelmail | =1.4.16 | |
| Squirrelmail Squirrelmail | =1.4-rc1 | |
| Squirrelmail Squirrelmail | =1.4.15_rc1 | |
| Squirrelmail Squirrelmail | =1.4.2-r5 | |
| Squirrelmail Squirrelmail | =1.4.4-rc1 | |
| Squirrelmail Squirrelmail | =1.4.15rc1 | |
| Squirrelmail Squirrelmail | =1.4.3 | |
| Squirrelmail Squirrelmail | =1.4.3-rc1 | |
| Squirrelmail Squirrelmail | =1.4.1 | |
| Squirrelmail Squirrelmail | =1.4.9 | |
| Squirrelmail Squirrelmail | =1.4.0_rc2a | |
| Squirrelmail Squirrelmail | =1.4.8 | |
| Squirrelmail Squirrelmail | =1.4.0_rc1 | |
| Squirrelmail Squirrelmail | =1.4.6_cvs | |
| Squirrelmail Squirrelmail | =1.4.0 | |
| Squirrelmail Squirrelmail | =1.4.0-rc1 | |
| Squirrelmail Squirrelmail | =1.4 | |
| Squirrelmail Squirrelmail | =1.4.0-rc2a | |
| Squirrelmail Squirrelmail | =1.44 | |
| Squirrelmail Squirrelmail | =1.4.5-rc1 | |
| Squirrelmail Squirrelmail | =1.4.10 | |
| Squirrelmail Squirrelmail | =1.4.3a | |
| Squirrelmail Squirrelmail | =1.4.2-r1 | |
| Squirrelmail Squirrelmail | =1.4.6-rc1 | |
| Squirrelmail Squirrelmail | =1.4_rc1 | |
| Squirrelmail Squirrelmail | =1.4.15-rc1 | |
| Squirrelmail Squirrelmail | =1.4.2-r2 | |
| Squirrelmail Squirrelmail | =1.4.8.4fc6 | |
| Squirrelmail Squirrelmail | =1.4.10a | |
| Squirrelmail Squirrelmail | =1.4.4 | |
| Squirrelmail Squirrelmail | =1.4.2-r4 | |
| Squirrelmail Squirrelmail | =1.4.18 | |
| Squirrelmail Squirrelmail | =1.4.3aa | |
| Squirrelmail Squirrelmail | <=1.4.20 | |
| Squirrelmail Squirrelmail | =1.4.11 | |
| Squirrelmail Squirrelmail | =1.4.5 | |
| Squirrelmail Squirrelmail | =1.4.3_rc1-r1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2010/dsa-2091
- http://www.securityfocus.com/bid/42399
- http://www.vupen.com/english/advisories/2010/2070
- http://secunia.com/advisories/40964
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972
- http://squirrelmail.org/security/issue/2010-07-23
- http://www.vupen.com/english/advisories/2010/2080
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html
- http://secunia.com/advisories/40971
- https://bugzilla.redhat.com/show_bug.cgi?id=618096
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
- http://support.apple.com/kb/HT5130
- http://rhn.redhat.com/errata/RHSA-2012-0103.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61124
- http://www.squirrelmail.org/security/issue/2010-07-23
- https://rhn.redhat.com/errata/RHSA-2012-0103.html
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-historical
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2010-2813
- vendor/squirrelmail
- canonical/squirrelmail squirrelmail
- version/squirrelmail squirrelmail/1.4.2
- version/squirrelmail squirrelmail/1.4.5_rc1
- version/squirrelmail squirrelmail/1.4.17
- version/squirrelmail squirrelmail/1.4.6_rc1
- version/squirrelmail squirrelmail/1.4.19
- version/squirrelmail squirrelmail/1.4.3_r3
- version/squirrelmail squirrelmail/1.4.0-r1
- version/squirrelmail squirrelmail/1.4.13
- version/squirrelmail squirrelmail/1.4.12
- version/squirrelmail squirrelmail/1.4.9a
- version/squirrelmail squirrelmail/1.4.6
- version/squirrelmail squirrelmail/1.4.3-r3
- version/squirrelmail squirrelmail/1.4.7
- version/squirrelmail squirrelmail/1.4.3_rc1
- version/squirrelmail squirrelmail/1.4.15
- version/squirrelmail squirrelmail/1.4.2-r3
- version/squirrelmail squirrelmail/1.4.4_rc1
- version/squirrelmail squirrelmail/1.4.16
- version/squirrelmail squirrelmail/1.4-rc1
- version/squirrelmail squirrelmail/1.4.15_rc1
- version/squirrelmail squirrelmail/1.4.2-r5
- version/squirrelmail squirrelmail/1.4.4-rc1
- version/squirrelmail squirrelmail/1.4.15rc1
- version/squirrelmail squirrelmail/1.4.3
- version/squirrelmail squirrelmail/1.4.3-rc1
- version/squirrelmail squirrelmail/1.4.1
- version/squirrelmail squirrelmail/1.4.9
- version/squirrelmail squirrelmail/1.4.0_rc2a
- version/squirrelmail squirrelmail/1.4.8
- version/squirrelmail squirrelmail/1.4.0_rc1
- version/squirrelmail squirrelmail/1.4.6_cvs
- version/squirrelmail squirrelmail/1.4.0
- version/squirrelmail squirrelmail/1.4.0-rc1
- version/squirrelmail squirrelmail/1.4
- version/squirrelmail squirrelmail/1.4.0-rc2a
- version/squirrelmail squirrelmail/1.44
- version/squirrelmail squirrelmail/1.4.5-rc1
- version/squirrelmail squirrelmail/1.4.10
- version/squirrelmail squirrelmail/1.4.3a
- version/squirrelmail squirrelmail/1.4.2-r1
- version/squirrelmail squirrelmail/1.4.6-rc1
- version/squirrelmail squirrelmail/1.4_rc1
- version/squirrelmail squirrelmail/1.4.15-rc1
- version/squirrelmail squirrelmail/1.4.2-r2
- version/squirrelmail squirrelmail/1.4.8.4fc6
- version/squirrelmail squirrelmail/1.4.10a
- version/squirrelmail squirrelmail/1.4.4
- version/squirrelmail squirrelmail/1.4.2-r4
- version/squirrelmail squirrelmail/1.4.18
- version/squirrelmail squirrelmail/1.4.3aa
- version/squirrelmail squirrelmail/1.4.20
- version/squirrelmail squirrelmail/1.4.11
- version/squirrelmail squirrelmail/1.4.5
- version/squirrelmail squirrelmail/1.4.3_rc1-r1