Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveRedhatCVE-2009-1381
HistoryMay 22, 2009 - 8:30 p.m.

CVE-2009-1381

2009-05-2220:30:00
redhat
web.nvd.nist.gov
46
squirrelmail
map_yp_alias
remote attackers
arbitrary commands
cve-2009-1381
nvd
debian gnu/linux
shell metacharacters

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.043

Percentile

92.3%

JSON

The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.

Affected configurations

Nvd
Node
squirrelmailimap_general.phpMatch1.2.2
OR
squirrelmailsquirrelmailMatch1.2.5
OR
squirrelmailsquirrelmailMatch1.2.6
OR
squirrelmailsquirrelmailMatch1.2.6-rc1
OR
squirrelmailsquirrelmailMatch1.2.7
OR
squirrelmailsquirrelmailMatch1.2.8
OR
squirrelmailsquirrelmailMatch1.2.9
OR
squirrelmailsquirrelmailMatch1.2.10
OR
squirrelmailsquirrelmailMatch1.2.11
OR
squirrelmailsquirrelmailMatch1.4.0
OR
squirrelmailsquirrelmailMatch1.4.0-r1
OR
squirrelmailsquirrelmailMatch1.4.1
OR
squirrelmailsquirrelmailMatch1.4.2
OR
squirrelmailsquirrelmailMatch1.4.2-r1
OR
squirrelmailsquirrelmailMatch1.4.2-r2
OR
squirrelmailsquirrelmailMatch1.4.2-r3
OR
squirrelmailsquirrelmailMatch1.4.2-r4
OR
squirrelmailsquirrelmailMatch1.4.2-r5
OR
squirrelmailsquirrelmailMatch1.4.3_rc1
OR
squirrelmailsquirrelmailMatch1.4.3_rc1r1
OR
squirrelmailsquirrelmail1.4.19-1
VendorProductVersionCPE
squirrelmailimap_general.php1.2.2cpe:2.3:a:squirrelmail:imap_general.php:1.2.2:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.5cpe:2.3:a:squirrelmail:squirrelmail:1.2.5:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.6cpe:2.3:a:squirrelmail:squirrelmail:1.2.6:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.6-rc1cpe:2.3:a:squirrelmail:squirrelmail:1.2.6-rc1:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.7cpe:2.3:a:squirrelmail:squirrelmail:1.2.7:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.8cpe:2.3:a:squirrelmail:squirrelmail:1.2.8:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.9cpe:2.3:a:squirrelmail:squirrelmail:1.2.9:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.10cpe:2.3:a:squirrelmail:squirrelmail:1.2.10:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.2.11cpe:2.3:a:squirrelmail:squirrelmail:1.2.11:*:*:*:*:*:*:*
squirrelmailsquirrelmail1.4.0cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*
Rows per page:
1-10 of 211

Related

openvas 37
nvd 2
cvelist 2
prion 2
ubuntucve 2
nessus 16
gentoo 1
debian 2
fedora 6
osv 3
veracode 1
cve 1
redhat 1
oraclelinux 1
centos 1
securityvulns 2
openvas
openvas
Mandrake Security Advisory MDVSA-2009:122 (squirrelmail)
2009-05-25 00:00:00
Mandrake Security Advisory MDVSA-2009:122 (squirrelmail)
2009-05-25 00:00:00
SquirrelMail Command Execution Vulnerability
2009-05-29 00:00:00
nvd
nvd
CVE-2009-1381
2009-05-22 20:30:00
CVE-2009-1579
2009-05-14 17:30:00
cvelist
cvelist
CVE-2009-1381
2009-05-22 20:00:00
CVE-2009-1579
2009-05-14 17:00:00
prion
prion
Code injection
2009-05-22 20:30:00
Design/Logic Flaw
2009-05-14 17:30:00
ubuntucve
ubuntucve
CVE-2009-1381
2009-05-22 00:00:00
CVE-2009-1579
2009-05-14 00:00:00
nessus
nessus
openSUSE 10 Security Update : squirrelmail (squirrelmail-6457)
2009-10-06 00:00:00
CentOS 3 / 5 : squirrelmail (CESA-2009:1066)
2009-05-28 00:00:00
RHEL 3 / 4 / 5 : squirrelmail (RHSA-2009:1066)
2009-05-27 00:00:00
gentoo
gentoo
SquirrelMail: Multiple vulnerabilities
2010-01-13 00:00:00
debian
debian
[SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix
2009-05-21 18:50:30
[SECURITY] [DSA 1802-1] New squirrelmail packages fix several vulnerabilities
2009-05-19 17:17:37
fedora
fedora
[SECURITY] Fedora 10 Update: squirrelmail-1.4.19-1.fc10
2009-05-25 21:20:59
[SECURITY] Fedora 9 Update: squirrelmail-1.4.19-1.fc9
2009-05-25 21:19:28
[SECURITY] Fedora 11 Update: squirrelmail-1.4.18-1.fc11
2009-05-13 00:22:47
osv
osv
squirrelmail - several vulnerabilities
2009-05-21 00:00:00
squirrelmail - incomplete fix
2009-05-21 00:00:00
Red Hat Security Advisory: squirrelmail security update
2024-09-15 17:57:29
veracode
veracode
Arbitrary Code Execution
2020-04-10 00:39:09
cve
cve
CVE-2009-1579
2009-05-14 17:30:00
redhat
redhat
(RHSA-2009:1066) Important: squirrelmail security update
2009-05-26 00:00:00
oraclelinux
oraclelinux
squirrelmail security update
2009-05-26 00:00:00
centos
centos
squirrelmail security update
2009-05-27 06:45:50
securityvulns
securityvulns
[ MDVSA-2009:110 ] squirrelmail
2009-05-13 00:00:00
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2009-05-13 00:00:00

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.5

Confidence

Low

EPSS

0.043

Percentile

92.3%

JSON
Related for CVE-2009-1381
openvas37nvd2cvelist2prion2ubuntucve2nessus16gentoo1debian2fedora6osv3veracode1cve1redhat1oraclelinux1centos1securityvulns2