Secunia has discovered a vulnerability in the Change_passwd plugin for SquirrelMail, which can be exploited by malicious, local users to gain escalated privileges.

The chpasswd utility creates a temporary file insecurely when updating a user's password. This can be exploited via symlink attacks to read the content of "/etc/shadow" or overwrite arbitrary files with "root" privileges.

The vulnerability has been confirmed in version 3.1 of the plugin. Prior versions are likely also affected.

Solution
Upgrade to version 4.0.
Further details available in Customer Area

Provided and/or discovered by
Carsten Eiram, Secunia Research.

Deep Links
Links available in Customer Area