copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2007.0513 -- [Win][UNIX/Linux] -- Multiple vulnerabilities in SquirrelMail G/PGP Plugin

Date: 12 July 2007

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                    ESB-2007.0513 -- [Win][UNIX/Linux]
           Multiple vulnerabilities in SquirrelMail G/PGP Plugin
                               12 July 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              SquirrelMail G/PGP Encryption Plugin
Publisher:            iDefense
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-4169 CVE-2005-1924

Original Bulletin:
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=555
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=331
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330
  http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=329

Comment: There are four iDefense bulletins contained in this advisory, each
         for a separate vulnerability in the SquirrelMail G/PGP Plugin.

- --------------------------BEGIN INCLUDED TEXT--------------------

SquirrelMail G/PGP Plugin deleteKey() Command Injection Vulnerability

iDefense Security Advisory 07.11.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 11, 2007

I. BACKGROUND

The SquirrelMail G/PGP Encrpytion Plugin is a general purpose
encryption, decryption, and digital signature plug-in for SquirrelMail
that implements the OpenPGP standard using GPG. More information is
available at the following URL.

http://www.squirrelmail.org/plugin_view.php?id=153

II. DESCRIPTION

Remote exploitation of a command injection vulnerability in the G/PGP
Encrpytion Plugin for The SquirrelMail Project Team's SquirrelMail
webmail package allows attackers to execute arbitrary commands with the
privileges of the underlying web server.

The problem specifically exists within the function deleteKey() defined
in gpg_keyring.php. A call is made to exec() with unfiltered
user-supplied data as demonstrated in the following piece of code:

    $command = "$path_to_gpg --batch --no-tty --yes --homedir \
                $gpg_key_dir $flag $fpr 2>&1";
    exec($command, $output, $returnval);

The deleteKey() routine is called from three files: import_key_file.php,
import_key_text.php and keyring_main.php. the '$fpr' variable from above
is supplied in the POST data. The attacker must have a valid
authenticated session to exploit this vulnerability.

III. ANALYSIS

Exploitation of the described vulnerability allows authenticated remote
attackers to execute arbitrary commands with the privileges of the
underlying web server.

This vulnerability could be exploited by webmail users to gain shell
access on the target server and potentially further compromise the
system with local privilege escalation vulnerabilities.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in the latest
version of the G/PGP Encryption Plugin for SquirrelMail, version 2.1.
Furthermore, this vulnerability has been confirmed to exist as early as
version 2.0. Other versions may be affected.

V. WORKAROUND

Disable the G/PGP Plugin if it is not required. Alternatively, add the
following line above the initialization of the '$command' variable just
prior to the call to exec():

    $fpr = escapeshellarg($fpr);

Please note that this is an unofficial source patch, but should be
sufficient as a workaround until an official patch is released from the
vendor.

VI. VENDOR RESPONSE

The maintainers of the SquirrelMail G/PGP plug-in have not responded to
repeated inquires regarding this vulnerability. As such, it remains
unpatched, even in the most current release made on July 7th, 2007.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2005-1924 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

10/27/2005  Initial vendor notification
10/27/2005  Initial vendor response
03/02/2006  Second vendor notification
02/16/2007  Third vendor notification
07/11/2007  Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright  2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

=============================================================================

SquirrelMail G/PGP Plugin gpg_check_sign_pgp_mime() Command Injection
Vulnerability

iDefense Security Advisory 07.11.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 11, 2007

I. BACKGROUND

The SquirrelMail G/PGP Encrpytion Plugin is a general purpose
encryption, decryption, and digital signature plug-in for SquirrelMail
that implements the OpenPGP standard using GPG. More information is
available at the following URL.

http://www.squirrelmail.org/plugin_view.php?id=153

II. DESCRIPTION

Remote exploitation of a command injection vulnerability in the G/PGP
Encrpytion Plugin for The SquirrelMail Project Team's SquirrelMail
webmail package allows attackers to execute arbitrary commands with the
privileges of the underlying web server.

The problem specifically exists within the function
gpg_check_sign_pgp_mime() defined in gpg_hook_functions.php. A call is
made to exec() with unfiltered user-supplied data as demonstrated in
the following piece of code:

    $command = "echo -n \"$messageSignedText\" | $path_to_gpg --batch \
               --no-tty --homedir $gpg_key_dir --verify ".\
               $detachedSignatureFilename."- 2>&1";

    if ($debug)
        echo "gpg command: ".$command."\";
        exec($command, $results, $returnval);

The '$messageSignedText' variable from above contains the stripped
e-mail message.

III. ANALYSIS

Exploitation of the described vulnerability allows unauthenticated
remote attackers to execute arbitrary commands with the privileges of
the underlying web server.

Exploitation of this vulnerability occurs when a target webmail user
opens a malicious e-mail message. As such the vulnerability can be
exploited by any attacker who can convince a target user to open a
malicious message.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in version
2.0 of the G/PGP Encryption Plugin for SquirrelMail. It is suspected
that earlier versions of the plug-in are also affected.

V. WORKAROUND

Disable the G/PGP Plugin if it is not required. Alternatively, add the
following line above the initialization of the '$command' variable just
prior to the call to exec():

    $messageSignedText= escapeshellarg($messageSignedText);

Please note that this is an unofficial source patch, but should be
sufficient as a workaround.

VI. VENDOR RESPONSE

The maintainers of the SquirrelMail G/PGP plug-in have not responded to
repeated inquires regarding this vulnerability. Versions since
2.1devbuild12Sep06 appear to include a fix for this problem. This
problem is not present in the recent 2.1 release made on July 7th,
2007.

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

10/27/2005  Initial vendor notification
10/27/2005  Initial vendor response
03/02/2006  Second vendor notification
02/16/2007  Third vendor notification
07/11/2007  Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright  2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

============================================================================

SquirrelMail G/PGP Plugin gpg_recv_key() Command Injection Vulnerability

iDefense Security Advisory 07.11.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 11, 2007

I. BACKGROUND

The SquirrelMail G/PGP Encrpytion Plugin is a general purpose
encryption, decryption, and digital signature plug-in for SquirrelMail
that implements the OpenPGP standard using GPG. More information is
available at the following URL.

http://www.squirrelmail.org/plugin_view.php?id=153

II. DESCRIPTION

Remote exploitation of a command injection vulnerability in the G/PGP
Encrpytion Plugin for The SquirrelMail Project Team's SquirrelMail
webmail package allows attackers to execute arbitrary commands with the
privileges of the underlying web server.

The problem specifically exists within the function gpg_recv_key()
defined in gpg_key_functions.php. A call is made to exec() with
unfiltered user-supplied data as demonstrated in the following piece of
code:

    $command = "$path_to_gpg --batch --no-tty --homedir $gpg_key_dir \
             --keyserver hkp://$keyserver --recv-key $searchkeyid 2>&1";
    [...]
    exec($command, $output, $returnval);

The aforementioned '$keyserver' variable is supplied in the POST data to
the gpg_options.php script. The attacker must have a valid authenticated
session to exploit this vulnerability.

III. ANALYSIS

Exploitation of the described vulnerability allows authenticated remote
attackers to execute arbitrary commands with the privileges of the
underlying web server.

This vulnerability could be exploited by webmail users to gain shell
access on the target server and potentially further compromise the
system with local privilege escalation vulnerabilities.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in the latest
version of the G/PGP Encryption Plugin for SquirrelMail, version 2.1.
Furthermore, this vulnerability has been confirmed to exist as early as
version 2.0. Other versions may be affected.

V. WORKAROUND

Disable the G/PGP Plugin if it is not required. Alternatively, add the
following line above the initialization of the '$command' variable just
prior to the call to exec():

    $keyserver = escapeshellarg($keyserver);

Please note that this is an unofficial source patch, but should be
sufficient as a workaround until an official patch is released from the
vendor.

VI. VENDOR RESPONSE

The maintainers of the SquirrelMail G/PGP plug-in have not responded to
repeated inquires regarding this vulnerability. As such, it remains
unpatched, even in the most current release made on July 7th, 2007.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2005-1924 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

10/27/2005  Initial vendor notification
10/27/2005  Initial vendor response
03/02/2006  Second vendor notification
02/16/2007  Third vendor notification
07/11/2007  Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright  2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

============================================================================

SquirrelMail G/PGP Plugin gpg_help.php Local File Inclusion Vulnerability

iDefense Security Advisory 07.11.07
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 11, 2007

I. BACKGROUND

The SquirrelMail G/PGP Encrpytion Plugin is a general purpose
encryption, decryption, and digital signature plug-in for SquirrelMail
that implements the OpenPGP standard using GPG. More information is
available at the following URL.

http://www.squirrelmail.org/plugin_view.php?id=153

II. DESCRIPTION

Remote exploitation of a local file inclusion vulnerability in version
2.0 of the SquirrelMail G/PGP Plugin could allow an authenticated
webmail user to execute arbitrary PHP code under the security context
of the running web server.

Version 2.0 of the SquirrelMail G/PGP Plugin contains an implementation
flaw in the way it includes certain files. Specifically, the
'gpg_help.php' and 'gpg_help_base.php' files will include local files
that are supplied via the 'help' HTTP GET request parameter. An excerpt
from the code follows:

    68  // Help body text is inserted here via GET parameter
    69  require_once (SM_PATH.'plugins/gpg/help/' . $_GET['help'] );

By using directory traversal specifiers, an attacker can trivially cause
files stored on the Web server to be parsed as PHP code.

III. ANALYSIS

Exploitation could allow an attacker to include an arbitrary local file
on the affected host.

Due to the lack of input validation on $GET_['help'], directory
traversal specifiers could be utilized to parse any file on the system
as PHP code.

IV. DETECTION

iDefense has confirmed the existence of this vulnerability in version
2.0 of the G/PGP Encryption Plugin for SquirrelMail. It is suspected
that earlier versions of the plug-in are also affected.

V. WORKAROUND

iDefense is unaware of any available workarounds for this vulnerability.

VI. VENDOR RESPONSE

The maintainers of the SquirrelMail G/PGP plug-in have not responded to
repeated inquires regarding this vulnerability. Versions since
gpg.2.1devbuild14Jun07 appear to include a fix for this problem. This
problem is not present in the recent 2.1 release made on July 7th,
2007.

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CVE-2006-4169 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org/), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

08/16/2006  Initial vendor notification
10/06/2006  Second vendor notification
02/16/2007  Third vendor notification
07/11/2007  Public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright  2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
 There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRpV+dCh9+71yA2DNAQIFWQP+IUfkbrNX2t+fUwZikAV06MJj5cblwRTs
sd5SPqFl4lRkDU766+U30+cFRUdeAd7oRnIcD2gY1StOqfgP+4uduj0uM63SrRT2
5yDGTsCWXI53nq8hdgFfF/PxLHYP+mdCPK2RDJIBtekovQndfS6XW9IPXSt+upV0
bcgf6VNC0Fg=
=fozm
-----END PGP SIGNATURE-----