REDHAT-BUG-618096: Low severity Squirrelmail Squirrelmail vulnerability
A denial of service flaw was found in the way SquirrelMail processed random login attempts with 8-bit characters in the password. A remote attacker could use this flaw to cause the server system potentially to run out of the hard disk space via random login attempts, causing SquirrelMail temporarily to accept the login and create a preferences file for the given username.
References: [1] http://www.squirrelmail.org/security/issue/2010-07-23
Upstream patch: [2] http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-14-STABLE/squirrelmail/functions/imapgeneral.php?view=patch&r1=13972&r2=13971&pathrev=13972
Affected Versions: <= v1.4.20
Register Globals: Registerglobals does not have to be on for this issue.
Credit: Issue discovered by Mikhail Goriachev
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-618096?
The severity of REDHAT-BUG-618096 is categorized as a denial of service vulnerability.
How do I fix REDHAT-BUG-618096?
To fix REDHAT-BUG-618096, upgrade SquirrelMail to version 1.4.21 or later.
What causes the vulnerability in REDHAT-BUG-618096?
The vulnerability in REDHAT-BUG-618096 is caused by SquirrelMail's improper handling of random login attempts with 8-bit characters in passwords.
Who is affected by REDHAT-BUG-618096?
Any user running SquirrelMail version 1.4.20 or lower is affected by REDHAT-BUG-618096.
Can REDHAT-BUG-618096 lead to data loss?
Yes, REDHAT-BUG-618096 can lead to potential data loss as it may cause the server to run out of hard disk space.