Summary
The remote host is missing updates announced in
advisory RHSA-2009:1490.
SquirrelMail is a standards-based webmail package written in PHP.
Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery (CSRF) attacks. If a remote attacker tricked a user into visiting a malicious web page, the attacker could hijack that user's authentication, inject malicious content into that user's preferences, or possibly send mail without that user's permission.
(CVE-2009-2964)
Users of SquirrelMail should upgrade to this updated package, which contains a backported patch to correct these issues.
Solution
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date
References
Severity
Classification
-
CVE CVE-2009-2964 -
CVSS Base Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P
Related Vulnerabilities