Bugtraq mailing list archives
GLSA: squirrelmail
From: Daniel Ahlberg <aliz () gentoo org>
Date: Sun, 15 Dec 2002 15:38:48 +0100
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200212-4 - - -------------------------------------------------------------------- PACKAGE : squirrelmail SUMMARY : cross site scripting DATE : 2002-12-15 14:12 UTC EXPLOIT : remote - - -------------------------------------------------------------------- euronymous <just-a-user () yandex ru> found that read_body.php didn't filter out user input for 'filter_dir' and 'mailbox', making a xss attack possible. Read the full advisory at http://f0kp.iplus.ru/bz/008.txt SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/squirrelmail-1.2.9 and earlier update their systems as follows: emerge rsync emerge squirrelmail emerge clean - - -------------------------------------------------------------------- aliz () gentoo org - GnuPG key is available at www.gentoo.org/~aliz - - -------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE9/JPrfT7nyhUpoZMRAuUKAJ98w49ZxG/AzqPtINkcLHt83S568wCfeq+N X8vYK73anWOOTITkoBwMRsY= =5d7Y -----END PGP SIGNATURE-----
Current thread:
- GLSA: squirrelmail Daniel Ahlberg (Dec 16)