===================================================================== CERT-Renater Note d'Information No. 2008/VULN626 _____________________________________________________________________ DATE : 24/12/2008 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running squirrelmail. ====================================================================== http://lists.debian.org/debian-security-announce/2008/msg00274.html ______________________________________________________________________ - ------------------------------------------------------------------------ Debian Security Advisory DSA-168201 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst December 07, 2008 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : squirrelmail Vulnerability : insufficient input sanitising Problem type : remote Debian-specific: no CVE Id(s) : CVE-2008-2379 Ivan Markovic discovered that SquirrelMail, a webmail application, did not sufficiently sanitise incoming HTML email, allowing an attacker to perform cross site scripting through sending a malicious HTML email. For the stable distribution (etch), this problem has been fixed in version 1.4.9a-3. For the unstable distribution (sid), this problem has been fixed in version 1.4.15-4. We recommend that you upgrade your squirrelmail package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Source archives: http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3.diff.gz Size/MD5 checksum: 23420 b1755b11f721f2bdc7c5a100cf83f1d6 http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a.orig.tar.gz Size/MD5 checksum: 598950 5b19f8cc5badef91d1f2410df41564bc http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3.dsc Size/MD5 checksum: 1021 9954f8522b7059cb115f5a77405c298f Architecture independent packages: http://security.debian.org/pool/updates/main/s/squirrelmail/squirrelmail_1.4.9a-3_all.deb Size/MD5 checksum: 591892 35c2060553f375b9bd8759d06b401153 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================