oss-sec mailing list archives
Strange CVE situation (at least one ID should come of this)
From: Josh Bressers <bressers () redhat com>
Date: Fri, 26 Oct 2012 15:54:15 -0400 (EDT)
Hello, This Squirrelmail plugin came to my attention a few weeks back: http://squirrelmail.org/plugin_view.php?id=117 It's from 2004, which is suspect in itself, but I took a look after someone asked. It's pretty scary in there. If I was to list the security problems I found after a few minutes of looking, they are: * It uses MD5 passwords * The shadow file is directly modified without locking (which could lead to a race condition) * If you get the password wrong, it doesn't unlink the empty temporary file. None are really a big deal, you *could* run this and probably never notice these problems. Fundamentally though, this thing should get one CVE ID that basically say "don't use this". How have situations like this been handled in the past? I mailed the Squirrelmail security team. They never responded. Regardless of their response though, the plugin site says it has been downloaded more than 100K times, so I suspect it's still in use somewhere. My goal in this CVE request is to raise awareness so hopefully people stop using this (and get the Squirrelmail guys to remove it from their site). Thanks. -- JB
Current thread:
- Strange CVE situation (at least one ID should come of this) Josh Bressers (Oct 26)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Seth Arnold (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Steven M. Christey (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Henri Salo (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 30)
- Re: [security] [oss-security] Strange CVE situation (at least one ID should come of this) Greg Knaddison (Oct 31)
- Re: Strange CVE situation (at least one ID should come of this) Seth Arnold (Oct 29)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 30)
- Re: Strange CVE situation (at least one ID should come of this) Steven M. Christey (Oct 31)
- Re: Strange CVE situation (at least one ID should come of this) Josh Bressers (Nov 02)
- Re: Strange CVE situation (at least one ID should come of this) Kurt Seifried (Oct 29)