Products
Solutions
Customers
Partner
Resources
Company
Careers
Community

CVE Reference: CVE-2009-2964

NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE:
CVE-2009-2964

Description:
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

CVE Status:
Candidate

References:

XF
  http://xforce.iss.net/xforce/xfdb/52406

SAID
  Secunia Advisory: SA40964
  Secunia Advisory: SA34627
  Secunia Advisory: SA36363
  Secunia Advisory: SA37415
  Secunia Advisory: SA40220

OVAL
  http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10668

OSVDB
  57001
  60469

MANDRIVA
  http://www.mandriva.com/security/advisories?name=MDVSA-2009:222

JVNDB
  http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html

JVN
  http://jvn.jp/en/jp/JVN30881447/index.html

FEDORA

DEBIAN
  http://www.debian.org/security/2010/dsa-2091

CONFIRM
  http://support.apple.com/kb/HT4188
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
  http://download.gna.org/nasmail/nasmail-1.7.zip
  http://www.squirrelmail.org/security/issue/2009-08-12
  http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
  http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818

BID
  36196

APPLE
  http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html


Return to the previous page.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability