Bug 94945 (CVE-2005-2095)

Hi,
we have another one. 

From: Thijs Kinkhorst <kink@squirrelmail.org>
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
To: vendor-sec@lst.de
Subject: [vendor-sec] SquirrelMail vulnerability in options_identites.php
Errors-To: vendor-sec-admin@lst.de
Date: Fri, 01 Jul 2005 10:21:18 +0200

[-- PGP Ausgabe folgt (aktuelle Zeit: Fr 01 Jul 2005 11:39:59 CEST) --]
gpg: Unterschrift vom Fr 01 Jul 2005 10:21:20 CEST, DSA SchlÃŒssel ID 957D58CF
gpg: Unterschrift kann nicht geprÃŒft werden: Ãffentlicher SchlÃŒssel nicht gefunden
[-- Ende der PGP-Ausgabe --]

[-- Die folgenden Daten sind signiert --]

[-- Anhang #1 --]
[-- Typ: text/plain, Kodierung: 7bit, GröÃe: 1,1K --]

Hello all,

A new vulnerability has been discovered in SquirrelMail. The file
src/options_identities.php contained some very bad, legacy code: an
extract($_POST) was done, effectively allowing a malicious attacker to
change session variables and even other people's preferences.

It must be noted that for this to happen you need to trick someone into
using an external form to post the information which is not trivial.

Affected versions:
1.4.0 - 1.4.5-RC1  (current stable tree)
1.2.8 - 1.2.10     (unsupported old stable tree)
1.5.x CVS          (unsupported current development tree)

Not vulnerable:
Everything before 1.2.8.

Our proposed patch is attached; unfortunately we had to rework some
functions to fix them the right way because the previous code really
depended to the extract() call.

We will release 1.4.5 sometime next week with the patch included. Fixes
for unsupported trees will be applied to their CVS branches but no new
releases will be made.

Credits for finding the issue go to James Bercegay of GulfTech Security
Research.

Regards,
Thijs Kinkhorst
SquirrelMail Development Team

[-- Anhang #2: sqm_144_ident.diff --]
[-- Typ: text/plain, Kodierung: 7bit, GröÃe: 20K --]

===================================================================