CVE-2010-1637

Published: Jun 22, 2010Modified: Apr 29, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

Affected (9)

Products: Squirrelmail: Squirrelmail · Fedoraproject: Fedora · Apple: Mac Os X, Mac Os X Server · +1 more

Show all products

Squirrelmail: Squirrelmail · Fedoraproject: Fedora · Apple: Mac Os X, Mac Os X Server · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation

1 product

1 product

2 products

3 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Squirrelmail Squirrelmail	Up to 1.4.20

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 11
Fedoraproject Fedora	Version 12
Fedoraproject Fedora	Version 13

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.6.8
Apple Mac Os X Server	Before 10.6.8

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Workstation	Version 5.0

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (40)

http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69

Source: secalert@redhat.com

Broken Link

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.html

Source: secalert@redhat.com

Mailing List

http://rhn.redhat.com/errata/RHSA-2012-0103.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/40307

Source: secalert@redhat.com

Broken Link

http://squirrelmail.org/security/issue/2010-06-21

Source: secalert@redhat.com

PatchVendor Advisory

http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/functions.php?r1=13951&r2=13950&pathrev=13951

Source: secalert@redhat.com

Product

http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/options.php?r1=13951&r2=13950&pathrev=13951

Source: secalert@redhat.com

Patch

http://support.apple.com/kb/HT5130

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2010:120

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2010/05/25/3

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2010/05/25/9

Source: secalert@redhat.com

Mailing List

http://www.openwall.com/lists/oss-security/2010/06/21/1

Source: secalert@redhat.com

Mailing ListPatch

http://www.securityfocus.com/bid/40291

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/40307

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2010/1535

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2010/1536

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2010/1554

Source: secalert@redhat.com

Broken Link

http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69