[ GLSA 201709-13 ] SquirrelMail

[GLSA]

Gentoo Linux Security Advisory

Title: SquirrelMail: Remote Code Execution (GLSA 201709-13)
Severity: normal
Exploitable: remote
Date: 2017-09-17
Bug(s): #616700
ID: 201709-13

Synopsis

A vulnerability in SquirrelMail might allow remote attackers to
execute arbitrary code.


Background

SquirrelMail is a webmail package written in PHP. It supports IMAP and
SMTP and can optionally be installed with SQL support.


Affected Packages

Package: mail-client/squirrelmail
Vulnerable: < 1.4.23_pre20140426
Architectures: All supported architectures


Description

It was discovered that the sendmail.cf file is mishandled in a popen
call.


Impact

A remote attacker, by enticing a user to open an e-mail attachment,
could execute arbitrary shell commands.


Workaround

There is no known workaround at this time.

Resolution

Gentoo has discontinued support for SquirrelMail and recommends that
users unmerge the package: