lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 30 May 2004 03:15:44 +0200
From: Roman Medina <roman@...labs.com>
To: full-disclosure@...ts.netsys.com
Cc: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: RS-2004-1: SquirrelMail "Content-Type" XSS vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I discovered a new XSS vuln in SquirrelMail which is quite dangerous
since it could be exploited simply by sending a specially crafted mail
to the victim. The victim only has to read the email in order to
trigger the exploit. This bug is present in latest versions (as well
as older ones).

I also noticed that latest Debian stable distro ships a very old
version of SquirrelMail, which is vulnerable to several old XSS bugs
(in addition to the new one).

Detailed info is included in attached advisory. Just in case of
problems with the attachment, you can download it from my site:
http://www.rs-labs.com/adv/RS-Labs-Advisory-2004-1.txt

Finally, I'd like to publicly state that somebody is using my nickname
(RoMaNSoFt) for mass-defacing PHP-Nuke sites (and some other nasty
actions like claiming to be the author of docs written by me) in a
clear attempt to incriminate myself. I'm not either a defacer, neither
a cracker. So please, don't mistake that script-kiddie with the real
RoMaNSoFt. Contact me for additional information or if you've been
affected/attacked by this likely Moroccan kiddie.

Regards from Spain,
 --Roman

- --
PGP Fingerprint:
09BB EFCD 21ED 4E79 25FB  29E1 E47F 8A7D EAD5 6742
[Key ID: 0xEAD56742. Available at KeyServ]
-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

iQA/AwUBQLh7SOR/in3q1WdCEQL4kgCgjiwOlryda2lDHgszFmg3pX6tlrIAoLhR
34XnlOcYqsDDAv3Xl2A/5rzj
=Gz6D
-----END PGP SIGNATURE-----


View attachment "RS-Labs-Advisory-2004-1.txt" of type "text/plain" (32168 bytes)

Powered by blists - more mailing lists