86823 2002-12-16 15:37 /41 rader/ Daniel Ahlberg <aliz@gentoo.org> Importerad: 2002-12-16 15:37 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Mottagare: Bugtraq (import) <2759> Ärende: GLSA: squirrelmail ------------------------------------------------------------ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200212-4 - - -------------------------------------------------------------------- PACKAGE : squirrelmail SUMMARY : cross site scripting DATE : 2002-12-15 14:12 UTC EXPLOIT : remote - - -------------------------------------------------------------------- euronymous <just-a-user@yandex.ru> found that read_body.php didn't filter out user input for 'filter_dir' and 'mailbox', making a xss attack possible. Read the full advisory at http://f0kp.iplus.ru/bz/008.txt SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/squirrelmail-1.2.9 and earlier update their systems as follows: emerge rsync emerge squirrelmail emerge clean - - -------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz - - -------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE9/JPrfT7nyhUpoZMRAuUKAJ98w49ZxG/AzqPtINkcLHt83S568wCfeq+N X8vYK73anWOOTITkoBwMRsY= =5d7Y -----END PGP SIGNATURE----- (86823) /Daniel Ahlberg <aliz@gentoo.org>/(Ombruten)