Gentoo: squirrelmail XSS vulnerability
read_body.php didn't filter out user input for 'filter_dir' and 'mailbox', making a xss attack possible.
Summary
- -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200212-4 - -------------------------------------------------------------------- DATE : 2002-12-15 14:12 UTC
- --------------------------------------------------------------------
euronymous <just-a-user@yandex.ru> found that read_body.php didn't filter out user input for 'filter_dir' and 'mailbox', making a xss attack possible.
Read the full advisory at /
SOLUTION
It is recommended that all Gentoo Linux users who are running net-mail/squirrelmail-1.2.9 and earlier update their systems as follows:
emerge rsync emerge squirrelmail emerge clean
- -------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - --------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : squirrelmail
SUMMARY : cross site scripting
EXPLOIT : remote
