CVE Database
CVE-2009-1579
| Impact: | Important (classification) |
| Public: | May 10 2009 |
| Bugzilla: | 500360: CVE-2009-1579 SquirrelMail: Server-side code injection in map_yp_alias username map |
Details
The MITRE CVE dictionary describes this issue as:
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.18 and NaSMail before 1.7 allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program.
Find out more about CVE-2009-1579 from the MITRE CVE dictionary and NIST NVD.
CVSS v2 metrics
| Base Score: | 7.5 | Base Metrics: | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Access Vector: | Network | Confidentiality Impact: | Partial |
| Access Complexity: | Low | Integrity Impact: | Partial |
| Authentication: | None | Availability Impact: | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat security errata
| Platform | Errata | Release Date |
| Red Hat Enterprise Linux version 3 (squirrelmail) | RHSA-2009:1066 | May 26 2009 |
| Red Hat Enterprise Linux version 4 (squirrelmail) | RHSA-2009:1066 | May 26 2009 |
| Red Hat Enterprise Linux version 5 (squirrelmail) | RHSA-2009:1066 | May 26 2009 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Red Hat Security Response Team.
