CVE-2010-4554: Input Validation
functions/pageheader.php in SquirrelMail 1.4.21 and earlier does not prevent page rendering inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Other sources
It was found that SquirrelMail webmail client did not properly handle generation of a particular web page HTML Header in cases, when entire application was loaded in separated HTML frame, potentially overloading other HTML elements on top of SquirrelMail's user interface. A remote attacker could use this flaw to obtain access to sensitive user data (passwords for example).
Upstream advisory: [1] http://www.squirrelmail.org/security/issue/2011-07-12
Relevant upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=revision&revision=14117
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4554?
CVE-2010-4554 has a medium severity rating due to its potential to enable clickjacking attacks.
How do I fix CVE-2010-4554?
To fix CVE-2010-4554, upgrade to SquirrelMail version 1.4.22 or later, where this vulnerability has been addressed.
What systems are affected by CVE-2010-4554?
CVE-2010-4554 affects SquirrelMail versions up to and including 1.4.21.
What type of attack is associated with CVE-2010-4554?
CVE-2010-4554 is associated with clickjacking attacks, allowing unauthorized actions to be performed by users.
Is there a workaround for CVE-2010-4554?
As a workaround for CVE-2010-4554, ensure that the SquirrelMail application is not displayed in iframes on external sites.