oss-security - Strange CVE situation (at least one ID should come of this)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <776078697.2526514.1351281255198.JavaMail.root@redhat.com>
Date: Fri, 26 Oct 2012 15:54:15 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Strange CVE situation (at least one ID should come of this)

Hello,

This Squirrelmail plugin came to my attention a few weeks back:
http://squirrelmail.org/plugin_view.php?id=117

It's from 2004, which is suspect in itself, but I took a look after someone
asked. It's pretty scary in there.

If I was to list the security problems I found after a few minutes of
looking, they are:

* It uses MD5 passwords
* The shadow file is directly modified without locking (which could lead to a
    race condition)
* If you get the password wrong, it doesn't unlink the empty temporary file.

None are really a big deal, you *could* run this and probably never notice
these problems.

Fundamentally though, this thing should get one CVE ID that basically say
"don't use this". How have situations like this been handled in the past?

I mailed the Squirrelmail security team. They never responded. Regardless
of their response though, the plugin site says it has been downloaded more
than 100K times, so I suspect it's still in use somewhere. My goal in this
CVE request is to raise awareness so hopefully people stop using this (and
get the Squirrelmail guys to remove it from their site).

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.