CVE Reference: CVE-2009-2964

NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE:
CVE-2009-2964

Description:
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.19 and earlier, and NaSMail before 1.7, allow remote attackers to hijack the authentication of unspecified victims via features such as send message and change preferences, related to (1) functions/mailbox_display.php, (2) src/addrbook_search_html.php, (3) src/addressbook.php, (4) src/compose.php, (5) src/folders.php, (6) src/folders_create.php, (7) src/folders_delete.php, (8) src/folders_rename_do.php, (9) src/folders_rename_getname.php, (10) src/folders_subscribe.php, (11) src/move_messages.php, (12) src/options.php, (13) src/options_highlight.php, (14) src/options_identities.php, (15) src/options_order.php, (16) src/search.php, and (17) src/vcard.php.

CVE Status:
Candidate

References:

XF
  http://xforce.iss.net/xforce/xfdb/52406

SAID
  Secunia Advisory: SA40964
  Secunia Advisory: SA34627
  Secunia Advisory: SA36363
  Secunia Advisory: SA37415
  Secunia Advisory: SA40220

OVAL
  http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10668

OSVDB
  57001
  60469

MANDRIVA
  http://www.mandriva.com/security/advisories?name=MDVSA-2009:222

JVNDB
  http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002207.html

JVN
  http://jvn.jp/en/jp/JVN30881447/index.html

FEDORA

DEBIAN
  http://www.debian.org/security/2010/dsa-2091

CONFIRM
  http://support.apple.com/kb/HT4188
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543818
  http://download.gna.org/nasmail/nasmail-1.7.zip
  http://www.squirrelmail.org/security/issue/2009-08-12
  http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13818
  http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/doc/ChangeLog?revision=13818&view=markup&pathrev=13818

BID
  36196

APPLE
  http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html


Return to the previous page.