REDHAT-BUG-618096
First published: Mon Jul 26 2010(Updated: )
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username. References: [1] <a href="http://www.squirrelmail.org/security/issue/2010-07-23">http://www.squirrelmail.org/security/issue/2010-07-23</a> Upstream patch: [2] <a href="http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972">http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972</a> Affected Versions: <= v1.4.20 Register Globals: Register_globals does not have to be on for this issue. Credit: Issue discovered by Mikhail Goriachev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SquirrelMail | <=1.4.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.squirrelmail.org/security/issue/2010-07-23
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972
- https://rhn.redhat.com/errata/RHSA-2012-0103.html
- https://bugzilla.redhat.com/show_bug.cgi?id=618096
Frequently Asked Questions
What is the severity of REDHAT-BUG-618096?
The severity of REDHAT-BUG-618096 is categorized as a denial of service vulnerability.
How do I fix REDHAT-BUG-618096?
To fix REDHAT-BUG-618096, upgrade SquirrelMail to version 1.4.21 or later.
What causes the vulnerability in REDHAT-BUG-618096?
The vulnerability in REDHAT-BUG-618096 is caused by SquirrelMail's improper handling of random login attempts with 8-bit characters in passwords.
Who is affected by REDHAT-BUG-618096?
Any user running SquirrelMail version 1.4.20 or lower is affected by REDHAT-BUG-618096.
Can REDHAT-BUG-618096 lead to data loss?
Yes, REDHAT-BUG-618096 can lead to potential data loss as it may cause the server to run out of hard disk space.
- collector/redhat-bugzilla
- alias/CVE-2010-2813
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/squirrelmail
- canonical/squirrelmail