Current time: 12-13-2018, 11:26 AM Hello There, Guest! (LoginRegister)


Post Reply 
CSRF in all SquirrelMail forms
Author Message
RatS Offline
Project Leader
******

Posts: 1,854
Joined: Oct 2006
Reputation: 17
Post: #1
Exclamation CSRF in all SquirrelMail forms
A few days ago, SquirrelMail announced an cross-site request forgery issue in all forms and versions below 1.4.20RC1 with the following text:

Quote:"All form submissions (send message, change preferences, etc.) in SquirrelMail were previously subject to cross-site request forgery (CSRF), wherein data could be sent to them from an offsite location, which could allow an attacker to inject malicious content into user preferences or possibly send emails without user consent."

To prevent your server from attacks, please use the updated SquirrelMail package for ispCP Omega. We recommend to update your SquirrelMail soon.

The original announcement can be found in the SquirrelMail homepage.
(This post was last modified: 08-18-2009 08:16 AM by RatS.)
08-18-2009 05:52 AM
Visit this user's website Find all posts by this user Quote this message in a reply
RatS Offline
Project Leader
******

Posts: 1,854
Joined: Oct 2006
Reputation: 17
Post: #2
RE: CSRF in all SquirrelMail forms
The missing "";" at the end of line 361 in functions/page_header.php is fixed now.

If you wonder how to install:
Code:
# cd /var/www/ispcp/gui/tools
# wget https://sourceforge.net/projects/ispcp/files/ispCP%20Omega/ispCP%20Omega%201.0.0/ispcp-squirrelmail-1.4.20rc1.tar.gz/download
# tar -xzf ispcp-squirrelmail-1.4.20rc1.tar.gz
# rm ispcp-squirrelmail-1.4.20rc1.tar.gz
# sh /var/www/ispcp/engine/setup/set-gui-permissions.sh
(This post was last modified: 08-18-2009 07:12 PM by RatS.)
08-18-2009 08:17 AM
Visit this user's website Find all posts by this user Quote this message in a reply
Post Reply 


Forum Jump:


User(s) browsing this thread: 1 Guest(s)