CVE-2010-2813: Medium severity Squirrelmail Squirrelmail vulnerability
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username.
References: [1] http://www.squirrelmail.org/security/issue/2010-07-23
Upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?view=patch&r1=13972&r2=13971&pathrev=13972
Affected Versions: <= v1.4.20
Register Globals: Registerglobals does not have to be on for this issue.
Credit: Issue discovered by Mikhail Goriachev
Other sources
functions/imapgeneral.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2813?
CVE-2010-2813 has a medium severity level as it can lead to a denial of service due to excessive disk space consumption.
How do I fix CVE-2010-2813?
To fix CVE-2010-2813, upgrade SquirrelMail to a version that addresses this vulnerability, specifically versions higher than 1.4.20.
What affected software versions are vulnerable to CVE-2010-2813?
Versions of SquirrelMail prior to 1.4.20, including 1.4.0 through 1.4.19, are affected by CVE-2010-2813.
How does CVE-2010-2813 work?
CVE-2010-2813 exploits the way SquirrelMail handles random login attempts using 8-bit characters in passwords.
Can CVE-2010-2813 be exploited remotely?
Yes, CVE-2010-2813 can be exploited remotely by attackers sending random login attempts to the SquirrelMail service.