CVE-2010-2813
En bref
- Source
- NVD
- EPSS
- EPSS 4.05 % · centile 91 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.
Faiblesses (CWE)
Références
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045383.html
- http://support.apple.com/kb/HT5130
- https://exchange.xforce.ibmcloud.com/vulnerabilities/61124
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/045372.html
- http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/functions/imap_general.php?view=patch&r1=13972&r2=13971&pathrev=13972
- http://www.debian.org/security/2010/dsa-2091
- http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
- http://secunia.com/advisories/40964
- http://www.vupen.com/english/advisories/2010/2080
- http://www.securityfocus.com/bid/42399
- http://rhn.redhat.com/errata/RHSA-2012-0103.html
- http://secunia.com/advisories/40971
- http://squirrelmail.org/security/issue/2010-07-23
- http://www.vupen.com/english/advisories/2010/2070
- https://bugzilla.redhat.com/show_bug.cgi?id=618096
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-2817
- GCVE · GCVE-0-2010-2813
Avis du CERT-FR
- CERTA-2012-AVI-054 — Vulnérabilités dans Mac OS X · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:squirrelmail:squirrelmail:*:*:*:*:*:*:*:*≤ 1.4.20cpe:2.3:a:squirrelmail:squirrelmail:1.4:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0:rc2a:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0-r1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.0_rc2a:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r2:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r3:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r4:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.2-r5:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:r3:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_r3:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3_rc1:r1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3a:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.3aa:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.4:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.4_rc1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.5:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.5_rc1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.6:rc1:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_cvs:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.6_rc1:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.7:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.8:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.8.4fc6:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.9:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.9a:*:*:*:*:*:*:*cpe:2.3:a:squirrelmail:squirrelmail:1.4.10:*:*:*:*:*:*:*- +14 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |