CentOS Update for squirrelmail CESA-2009:1066 centos3 i386

The remote host is missing an update for the 'squirrelmail' package(s) announced via the referenced advisory.

SquirrelMail is a standards-based webmail package written in PHP. A server-side code injection flaw was found in the SquirrelMail 'map_yp_alias' function. If SquirrelMail was configured to retrieve a user's IMAP server address from a Network Information Service (NIS) server via the 'map_yp_alias' function, an unauthenticated, remote attacker using a specially-crafted username could use this flaw to execute arbitrary code with the privileges of the web server. (CVE-2009-1579) Multiple cross-site scripting (XSS) flaws were found in SquirrelMail. An attacker could construct a carefully crafted URL, which once visited by an unsuspecting user, could cause the user's web browser to execute malicious script in the context of the visited SquirrelMail web page. (CVE-2009-1578) It was discovered that SquirrelMail did not properly sanitize Cascading Style Sheets (CSS) directives used in HTML mail. A remote attacker could send a specially-crafted email that could place mail content above SquirrelMail's controls, possibly allowing phishing and cross-site scripting attacks. (CVE-2009-1581) Users of squirrelmail should upgrade to this updated package, which contains backported patches to correct these issues.

squirrelmail on CentOS 3

Please install the updated packages.