Vulnerability in Squirrelmail Imap General.php
CVE-2009-1381
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
EPSS: 0.029 (85.7th percentile) — read the EPSS interpretation.
Affected products
- Squirrelmail Imap_general.php — versions 1.2.2
- Squirrelmail — versions 1.2.5, 1.2.6, 1.2.6-rc1
- Squirrelmail Squirrelmail1.4.19-1
- N/a — versions n/a
References
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (Exploit, x_refsource_MISC, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA)
- secalert@redhat.com (vendor-advisory, x_refsource_DEBIAN, Vendor Advisory)