Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2005-1924

Overview

Vulnerability Score 9.3 9.3
CVE Id CVE-2005-1924
Last Modified 30 Oct 2012 09:47:31
Published 31 Dec 2005 12:00:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2005-1924

Summary

The G/PGP (GPG) Plugin 2.1 and earlier for Squirrelmail allow remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the fpr parameter to the deleteKey function in gpg_keyring.php, as called by (a) import_key_file.php, (b) import_key_text.php, and (c) keyring_main.php; and (2) the keyserver parameter to the gpg_recv_key function in gpg_key_functions.php, as called by gpg_options.php. NOTE: this issue may overlap CVE-2007-3636.

Vulnerable Systems

Application

  • Squirrelmail Gpg Plugin 2.1


References

VUPEN - ADV-2007-2513

BID - 24874

BUGTRAQ - 20070711 SquirrelMail G/PGP Encryption Plug-in Remote Command Execution Vulnerability

VIM - 20070711 True: SquirrelMail G/PGP Encryption Plug-in 2.0 Command Execution Vuln

SECUNIA - 26035

MILW0RM - 4173

IDEFENSE - 20070711 SquirrelMail G/PGP Plugin gpg_recv_key() Command Injection Vulnerability

IDEFENSE - 20070711 SquirrelMail G/PGP Plugin deleteKey() Command Injection Vulnerability

XF - squirrelmail-gpgp-keyfunc-command-execution(35364)

XF - squirrelmail-gpgp-keyring-command-execution(35355)

GENTOO - GLSA-200708-08

SECUNIA - 26424

OSVDB - 37924

OSVDB - 37923


Last Updated: 27 May 2016 10:49:48