[UNIX] SquirrelMail Address Add Plugin XSS

From: SecuriTeam (support_at_securiteam.com)
Date: 09/29/05

  • Next message: SecuriTeam: "[UNIX] Serendipity Account Hijacking and CSRF Vulnerability" 
    To: list@securiteam.com
Date: 29 Sep 2005 16:53:04 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      SquirrelMail Address Add Plugin XSS
    ------------------------------------------------------------------------

    SUMMARY

    A XSS vulnerability has been detected in the Address Add Plugin for
    Squirrelmail. The problem is caused by insufficient input sanitation.

    DETAILS

    Vulnerable Systems:
     * Squirrelmail version 1.4.0 or newer with Address Add Plugin version 1.9
    or 2.0

    Immune Systems:
     * Squirrelmail version 1.4.0 or newer with Address Add Plugin version 2.1
    or newer

    Sending a HTML email containing an IMG tag which provides a SRC attribute
    pointing at the vulnerable plugin may allow an attacker to retrieve the
    victims' cookie and session information without the victim being aware.
    The exploit may be triggered when the victim clicks on a specially crafted
    URL contained in the email and hovers the address book form field.

    The following partial URL demonstrates the issue:

    /squirrelmail_root_dir/plugins/address_add/add.php?
    first=HOVER%20ME!%22%20onMouseOver=%22alert('foo');

    Move your mouse pointer over the input field which says so.

    Other variables on this script can be misused in the same way.

    Disclosure Timeline:
    Sep 24, 2005: Maintainer informed
    Sep 25, 2005: First maintainer reply
    Sep 25, 2005: Maintainer provides fix
    Sep 29, 2005: Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:info@moritz-naumann.com>
    Moritz Naumann.
    The original article can be found at:
    <http://moritz-naumann.com/adv/0002/sqmadd/0002.txt>
    http://moritz-naumann.com/adv/0002/sqmadd/0002.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Serendipity Account Hijacking and CSRF Vulnerability"

    Relevant Pages

    • [EXPL] Gaim Stack Overflow (PoC)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A stack overflow vulnerability exists in Gaim, ... Ron just threw together a quick plugin (based on an old ...
      (Securiteam)
    • [UNIX] Gaim Festival Example Plugin Command Execution Vulnerability (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability exists in any plugin that has copied its code from the ... example plugin to execute arbitrary code. ...
      (Securiteam)
    • [UNIX] Squirrelmail Change_passwd Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... plugin, is "a Squirrelmail plugin to allow your users to change his/her ... The vulnerable code is inside mainfunction that neglects to verify ... GNU gdb 6.0-debian ...
      (Securiteam)
    • [UNIX] VLC Format String Vulnerability And Integer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... VLC Format String Vulnerability And Integer Overflow ... VLC is vulnerable to a format string attack in the parsing of Vorbis ... The SAP service discovery plugin must not enabled (it is disabled by ...
      (Securiteam)
    • [NT] Microsoft PowerPoint "Action Settings" Allows Invocation of Default Browser
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... When configured by the slide author, the PowerPoint "Action Settings" ... A victim is sent an email with a Microsoft PowerPoint file ... mouse pointer over the picture/object the page is launched using the ...
      (Securiteam)