[SM-ANNOUNCE] Security: patch fixes SquirrelMail cross site scripting vulnerabilities [CAN-2005-1769]

--=-I7SpaEff0BQsTjyPwR3r
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Dear SquirrelMail users,

Several cross site scripting (XSS) vulnerabilties have been discovered
in SquirrelMail versions 1.4.0 - 1.4.4. These have been addressed in a
patch that can be found at [1]. We advise all our users to apply this
patch. We're also releasing SquirrelMail 1.4.5 release candidate 1
today. We expect version 1.4.5 to be out within two weeks from
now.

The vulnerabilities are in two categories: the majority can be exploited
through URL manipulation, and some by sending a specially crafted email
to a victim. When done very carefully, this can cause the session of the
user to be hijacked.

We know that versions 1.4.0 to 1.4.3a are vulnerable to most of the
issues. The 1.2.x series is not supported anymore; we advise users of
that series to upgrade to 1.4.4 with the patch applied.

Credits: we would like to thank Martijn Brinkers who helped a lot in
finding these vulnerabilities, and Cor Bosman of XS4ALL who helped in
testing the proposed fixes.

If you have any questions or concerns, please turn to the
[email protected] mailinglist or the
#squirrelmail channel on irc.freenode.net.


Safe SquirrelMailing!

The SquirelMail Project Team

[1] http://prdownloads.sourceforge.net/squirrelmail/sqm-144-xss.patch

--=-I7SpaEff0BQsTjyPwR3r
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBCsKfgJdKMxZV9WM8RAl8LAJ42qYC5olOvDTTehj9JO94nhYWVJQCfbw5q
JqnOAZU7E2BEFUngjMhfY+o=
=wv7w
-----END PGP SIGNATURE-----

--=-I7SpaEff0BQsTjyPwR3r--


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click