CSRF in all SquirrelMail forms

[RatS]

A few days ago, SquirrelMail announced an cross-site request forgery issue in all forms and versions below 1.4.20RC1 with the following text:

Quote:"All form submissions (send message, change preferences, etc.) in SquirrelMail were previously subject to cross-site request forgery (CSRF), wherein data could be sent to them from an offsite location, which could allow an attacker to inject malicious content into user preferences or possibly send emails without user consent."

To prevent your server from attacks, please use the updated SquirrelMail package for ispCP Omega. We recommend to update your SquirrelMail soon.

The original announcement can be found in the SquirrelMail homepage.

[RatS]

The missing "";" at the end of line 361 in functions/page_header.php is fixed now.

If you wonder how to install:

Code:

# cd /var/www/ispcp/gui/tools
# wget https://sourceforge.net/projects/ispcp/files/ispCP%20Omega/ispCP%20Omega%201.0.0/ispcp-squirrelmail-1.4.20rc1.tar.gz/download
# tar -xzf ispcp-squirrelmail-1.4.20rc1.tar.gz
# rm ispcp-squirrelmail-1.4.20rc1.tar.gz
# sh /var/www/ispcp/engine/setup/set-gui-permissions.sh