1. CVE-Search
  2. CVE-2009-1381
ID CVE-2009-1381
Summary The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.
References
Vulnerable Configurations
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.6-rc1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.6-rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail1.4.19-1:*:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail1.4.19-1:*:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:imap_general.php:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:imap_general.php:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:r1:*:*:*:*:*:*
    cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:r1:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 13-02-2023 - 02:20)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
bugtraq 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix
debian DSA-1802
fedora
  • FEDORA-2009-5350
  • FEDORA-2009-5471
mandriva MDVSA-2009:122
misc http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff
secunia 35140
statements via4
contributor Tomas Hoger
lastmodified 2009-05-26
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of squirrelmail as shipped with Red Hat Enterprise Linux 3, 4, or 5. Updates for squirrelmail released via RHSA-2009:1066 (https://rhn.redhat.com/errata/RHSA-2009-1066.html) fixed original flaw CVE-2009-1579 without introducing CVE-2009-1381.
Last major update 13-02-2023 - 02:20
Published 22-05-2009 - 20:30
Last modified 13-02-2023 - 02:20
Back to Top