Bugzilla Bug 201323

From: Jon Angliss <jon@squirrelmail.org>
Subject: [SM-ANNOUNCE] RELEASE: SquirrelMail 1.4.12


Hello All,

It's my pleasure to announce the release of SquirrelMail 1.4.12.  This
release is a bug fix release, including a critical bug in the handling
of attachments.

The latest release can be downloaded from the SquirrelMail website at
http://www.squirrelmail.org/download.php

Package md5sums
===============
ea5e750797628c9f0f247009f8ae0e14  squirrelmail-1.4.12.tar.bz2
d17c1d9f1ee3dde2c1c21a22fc4f9d0e  squirrelmail-1.4.12.tar.gz
3f6514939ea1ebf69f6f8c92781886ab  squirrelmail-1.4.12.zip

--
Happy SquirrelMailing!
The SquirrelMail development team

I should have the new version up this weekend

From:   jon@squirrelmail.org
Subject: [SM-ANNOUNCE] ANNOUNCE: SquirrelMail 1.4.13 Released
Date: December 14, 2007 1:59:08 PM EST
To:   squirrelmail-announce@lists.sourceforge.net
Security: Signed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

Due to the package compromise of 1.4.11, and 1.4.12, we are forced to
release 1.4.13 to ensure no confusions. While initial review didn't
uncover a need for concern, several proof of concepts show that the
package alterations introduce a high risk security issue, allowing
remote inclusion of files. These changes would allow a remote user the
ability to execute exploit code on a victim machine, without any user
interaction on the victim's server. This could grant the attacker the
ability to deploy further code on the victim's server.

We *STRONGLY* advise all users of 1.4.11, and 1.4.12 upgrade
immediately.

Package MD5s
============
1a1bdad6245aaabcdd23d9402acb388e  squirrelmail-1.4.13.tar.bz2
51ddd67a7ff9272f5a6e1da0b9dfbf18  squirrelmail-1.4.13.tar.gz
ed8871a693cc57d5a0d511f7b89f8781  squirrelmail-1.4.13.zip

We apologies for the inconvenience this may have caused.

- --
Happy SquirrelMailing!
The SquirrelMail Development Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHYtKBK4PoFPj9H3MRAjiUAKDxM5V8J6vLEUAn7dfiIa1HYwKIWQCfYTbA
3nk8LOfqcBHfZ3IvEOXoOCo=
=USb7
-----END PGP SIGNATURE-----

Hi,

it was reported on the SM mailing list that the source package of 1.4.11 and
1.4.12 seem to have been modified. See this:

Date: Fri, 14 Dec 2007 12:59:08 -0600
From: Jon Angliss <jon@squirrelmail.org>
To: SquirrelMail - Announce <squirrelmail-announce@lists.sourceforge.net>
Subject: [SM-ANNOUNCE] ANNOUNCE: SquirrelMail 1.4.13 Released

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All,

Due to the package compromise of 1.4.11, and 1.4.12, we are forced to
release 1.4.13 to ensure no confusions. While initial review didn't
uncover a need for concern, several proof of concepts show that the
package alterations introduce a high risk security issue, allowing
remote inclusion of files. These changes would allow a remote user the
ability to execute exploit code on a victim machine, without any user
interaction on the victim's server. This could grant the attacker the
ability to deploy further code on the victim's server.

We *STRONGLY* advise all users of 1.4.11, and 1.4.12 upgrade
immediately.

Package MD5s
============
1a1bdad6245aaabcdd23d9402acb388e  squirrelmail-1.4.13.tar.bz2
51ddd67a7ff9272f5a6e1da0b9dfbf18  squirrelmail-1.4.13.tar.gz
ed8871a693cc57d5a0d511f7b89f8781  squirrelmail-1.4.13.zip

We apologies for the inconvenience this may have caused.

- --
Happy SquirrelMailing!
The SquirrelMail Development Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFHYtKBK4PoFPj9H3MRAjiUAKDxM5V8J6vLEUAn7dfiIa1HYwKIWQCfYTbA
3nk8LOfqcBHfZ3IvEOXoOCo=
=USb7
-----END PGP SIGNATURE-----

Would be better to update right to 1.4.13 as the email says.

As for security being in CC here: This does not affect Gentoo, as the checksum
distributed on our rsync mirrors and the file on our distfiles mirrors is
original and the mirroring happened before the file compromise:

486fb27a6ab306088603163160dbc8ca  squirrelmail-1.4.11.tar.bz2

The only way this could hit Gentoo users is when they cannot contact Gentoo
mirrors and get a compromised copy from an outdated Sourceforge mirror. That
would not cross the user's checksum verification though.

In portage.