[Dailydave] SquirrelMail GPG Plugin vuln

[Nicob]

Le lundi 09 juillet 2007 à 08:46 -0500, Charles Miller a écrit :
> Also, the vulnerability Nicob pointed out was pre-auth (mine was post-
> auth).

Simply sending an email to an user using the PGP plugin was enough to
compromise the server hosting SquirrelMail. That's nice, as the webmail
URL doesn't have to be known. The server can even be unreachable from
the Internet.

That's imho more than pre-auth, as you can blindly send tons of mails to
random addresses and compromise some servers.

592 function gpg_check_sign_pgp_mime($message,$fullbodytext) {
[...]
639 //$messageSignedText = escapeshellarg($messageSignedText);
640 $messageSignedText = ereg_replace("\"", "\\\"",$messageSignedText );
[...]
661 $command = "echo -n \"$messageSignedText\" | [blablabla]

Nicob