The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
SquirrelMail Address Add Plugin XSS
------------------------------------------------------------------------
SUMMARY
A XSS vulnerability has been detected in the Address Add Plugin for
Squirrelmail. The problem is caused by insufficient input sanitation.
DETAILS
Vulnerable Systems:
* Squirrelmail version 1.4.0 or newer with Address Add Plugin version 1.9
or 2.0
Immune Systems:
* Squirrelmail version 1.4.0 or newer with Address Add Plugin version 2.1
or newer
Sending a HTML email containing an IMG tag which provides a SRC attribute
pointing at the vulnerable plugin may allow an attacker to retrieve the
victims' cookie and session information without the victim being aware.
The exploit may be triggered when the victim clicks on a specially crafted
URL contained in the email and hovers the address book form field.
The following partial URL demonstrates the issue:
/squirrelmail_root_dir/plugins/address_add/add.php?
first=HOVER%20ME!%22%20onMouseOver=%22alert('foo');
Move your mouse pointer over the input field which says so.
Other variables on this script can be misused in the same way.
Disclosure Timeline:
Sep 24, 2005: Maintainer informed
Sep 25, 2005: First maintainer reply
Sep 25, 2005: Maintainer provides fix
Sep 29, 2005: Public disclosure
ADDITIONAL INFORMATION
The information has been provided by <mailto:info@moritz-naumann.com>
Moritz Naumann.
The original article can be found at:
<http://moritz-naumann.com/adv/0002/sqmadd/0002.txt>
http://moritz-naumann.com/adv/0002/sqmadd/0002.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
