OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: Sun Dec 15 2002 - 08:38:49 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200212-4
    - - --------------------------------------------------------------------

    PACKAGE : squirrelmail
    SUMMARY : cross site scripting
    DATE    : 2002-12-15 14:12 UTC
    EXPLOIT : remote

    - - --------------------------------------------------------------------

    euronymous <just-a-useryandex.ru> found that read_body.php didn't
    filter out user input for 'filter_dir' and 'mailbox', making a xss
    attack possible.

    Read the full advisory at
    http://f0kp.iplus.ru/bz/008.txt

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-mail/squirrelmail-1.2.9 and earlier update their systems as follows:

    emerge rsync
    emerge squirrelmail
    emerge clean

    - - --------------------------------------------------------------------
    alizgentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE9/JPrfT7nyhUpoZMRAuUKAJ98w49ZxG/AzqPtINkcLHt83S568wCfeq+N
    X8vYK73anWOOTITkoBwMRsY=
    =5d7Y
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html