Gentoo: GLSA-200408-02: Courier: Cross-site scripting vulnerability in SqWebMail
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gentoo Linux Security Advisory GLSA 200408-02 https://security.gentoo.org/
Severity: Normal Title: Courier: Cross-site scripting vulnerability in SqWebMail Date: August 04, 2004 Bugs: #58020 ID: 200408-02
Synopsis ======= The SqWebMail web application, included in the Courier suite, is vulnerable to cross-site scripting attacks.
Background ========= Courier is an integrated mail and groupware server based on open protocols. It provides ESMTP, IMAP, POP3, webmail, and mailing list services within a single framework. The webmail functionality included in Courier called SqWebMail allows you to access mailboxes from a web browser.
Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-mta/courier <= 0.45.6 >= 0.45.6.20040618
========== Luca Legato found that SqWebMail is vulnerable to a cross-site scripting (XSS) attack. An XSS attack allows an attacker to insert malicious code into a web-based application. SqWebMail doesn't filter appropriately data coming from message headers before displaying them.
Impact ===== By sending a carefully crafted message, an attacker can inject and execute script code in the victim's browser window. This allows to modify the behaviour of the SqWebMail application, and/or leak session information such as cookies to the attacker.
Workaround ========= There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of Courier.
Resolution ========= All Courier users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=mail-mta/courier-0.45.6.20040618" # emerge ">=mail-mta/courier-0.45.6.20040618"
References ========= [ 1 ] CAN-2004-0591 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0591 [ 2 ] XSS definition https://insights.sei.cmu.edu/library/2000-cert-advisories/
Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/200408-02
Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org/.
License ====== Copyright 2004 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/1.0/
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Thunderbird - iD8DBQFBEQXovcL1obalX08RAqg6AJ9GN2Cp6GME/aZSGSAKW27WosrGfACfYga2 Cwss+8VoQYFfibga3lkffy8=Tyco -----END PGP SIGNATURE-----