SquirrrelMail Vulnerability

[#1]

Hi,

I seem to recall that Plusnet Webmail is implemented with SquirrelMail.

Not sure which version you are running, but I think you need to look at this for the latest 1.4.22 release:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692

http://securityaffairs.co/wordpress/58336/hacking/squirrelmail-rce.html

https://youtu.be/ceoUkWDG7tc

Thanks, Neal.

[#2]

Already aware, thanks Neal.

[#3]

I use SM 1.4.23 as a webmail solution elsewhere so this interests me.

I looks like SM haven't released an official patch but the person who found the vulnerability released an unofficial patch? Just curious what the solution might be beyond switching webmail solutions?

[#4]

It's specific to installations that are configured to use Sendmail, so configuring Squirrel to use SMTP instead would be one way to ensure that you're not vulnerable.

[#5]

I would take a guess that Plusnet would be using SMTP anyway with SquirrelMail, so from what @bobpullen has said, this vulnerability would affect them.

[#6]

---

@pjmarsh wrote:

... so from what @bobpullen has said, this vulnerability would affect them.

I assume you meant to type wouldn't? 

---

[#7]

Sorry, @bobpullen, yes, that's exactly what I meant!