Bug 135921 - mail-client/squirrelmail <= 1.4.6 - Exposure of sensitive information
Bug#: 135921 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: minor Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: spida@spida.net
Component: Vulnerabilities
URL:  http://secunia.com/advisories/20406/
Summary: mail-client/squirrelmail <= 1.4.6 - Exposure of sensitive information
Keywords:  
Status Whiteboard: B4 [noglsa] DerCorny
Opened: 2006-06-07 07:15 0000
Description:   Opened: 2006-06-07 07:15 0000 
http://www.squirrelmail.org/changelog.php
the 1.4.7 release of squirrelmail fixes several bugs, at least on of them is
considered security-relevant.

------- Comment #1 From Jakub Moc (RETIRED) 2006-06-07 07:15:35 0000 ------- 
*** Bug 135922 has been marked as a duplicate of this bug. ***

------- Comment #2 From Jakub Moc (RETIRED) 2006-06-07 07:23:37 0000 ------- 
http://www.squirrelmail.org/security/issue/2006-06-01
http://secunia.com/advisories/20406/

Description:
Junker Broke has reported a vulnerability in Squirrelmail, which can be
exploited by malicious people to disclose certain sensitive information.

Input passed to the "plugins[]" parameter in functions/plugin.php is not
properly sanitised before being used to include files. This can be exploited to
include arbitrary files from local resources.

Successful exploitation requires that "register_globals" is enabled and
"magic_quotes_gpc" is disabled.

The vulnerability has been reported in version 1.4.6 and prior.

Solution:
Apply patch (see vendor advisory).

Provided and/or discovered by:
Junker Broke

Original Advisory:
http://www.squirrelmail.org/security/issue/2006-06-01

------- Comment #3 From Stefan Cornelius (RETIRED) 2006-06-07 07:36:37 0000 ------- 
eradicator please provide fixed ebuilds or tell us if 1.5.X is ready to go
stable, thanks

------- Comment #4 From Stefan Cornelius (RETIRED) 2006-06-13 03:18:52 0000 ------- 
eradicator doesnt respond, someone from net-mail please bump and/or comment

------- Comment #5 From Tuan Van (RETIRED) 2006-06-13 13:27:51 0000 ------- 
committed squirrelmail-1.4.6-r3 with the mentioned patch above.

------- Comment #6 From Sune Kloppenborg Jeppesen 2006-06-14 03:47:31 0000 ------- 
Arches please test and mark stable.

------- Comment #7 From Chris Gianelloni (RETIRED) 2006-06-14 06:04:22 0000 ------- 
x86 done... thanks to Ticho for testing...

------- Comment #8 From Tobias Scherbaum 2006-06-14 11:00:58 0000 ------- 
ppc stable

------- Comment #9 From Jon Hood (RETIRED) 2006-06-14 11:09:39 0000 ------- 
amd64 stable

------- Comment #10 From Thorsten Zantis 2006-06-14 11:34:03 0000 ------- 
 * Applying sec-135921.patch ...

 * Failed Patch: sec-135921.patch !
 *  ( /usr/portage/mail-client/squirrelmail/files/sec-135921.patch )
 *
 * Include in your bugreport the contents of:
 *
 *   /var/tmp/portage/squirrelmail-1.4.6-r3/temp/sec-135921.patch-2795.out


Bugzilla gives me an error when trying to attach above file, see it at
http://pastebin.com/709062

------- Comment #11 From Tuan Van (RETIRED) 2006-06-14 12:02:44 0000 ------- 
(In reply to comment #10)
>  * Applying sec-135921.patch ...
> 
>  * Failed Patch: sec-135921.patch !
>  *  ( /usr/portage/mail-client/squirrelmail/files/sec-135921.patch )
>  *
>  * Include in your bugreport the contents of:
>  *
>  *   /var/tmp/portage/squirrelmail-1.4.6-r3/temp/sec-135921.patch-2795.out
> 
> 
> Bugzilla gives me an error when trying to attach above file, see it at
> http://pastebin.com/709062
> 

Thorsten,
please comment and post your `emerge --info` in bug #136773

------- Comment #12 From Jason Wever (RETIRED) 2006-06-14 17:19:57 0000 ------- 
Stable on SPARC.

------- Comment #13 From Thomas Cort (RETIRED) 2006-06-15 18:05:45 0000 ------- 
alpha stable.

------- Comment #14 From Raphael Marichez 2006-06-19 03:25:16 0000 ------- 
time to vote.

i vote a full no : who has "register_globals=on" nowadays ? I guess they even
don't read any security advisory...

------- Comment #15 From Wolf Giesen (RETIRED) 2006-06-19 05:05:42 0000 ------- 
One more NO. No excuse. We're not the Gentoo Security Education Project...

------- Comment #16 From Sune Kloppenborg Jeppesen 2006-06-19 09:25:18 0000 ------- 
One more NO and closing. Feel free to reopen if you disagree.