-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200212-4 - - -------------------------------------------------------------------- PACKAGE : squirrelmail SUMMARY : cross site scripting DATE : 2002-12-15 14:12 UTC EXPLOIT : remote - - -------------------------------------------------------------------- euronymous <just-a-user@yandex.ru> found that read_body.php didn't filter out user input for 'filter_dir' and 'mailbox', making a xss attack possible. Read the full advisory at http://f0kp.iplus.ru/bz/008.txt SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/squirrelmail-1.2.9 and earlier update their systems as follows: emerge rsync emerge squirrelmail emerge clean - - -------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz - - -------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE9/JPrfT7nyhUpoZMRAuUKAJ98w49ZxG/AzqPtINkcLHt83S568wCfeq+N X8vYK73anWOOTITkoBwMRsY= =5d7Y -----END PGP SIGNATURE-----
