CSRF in all SquirrelMail forms
Benedikt Heintel
issue in all forms and versions below 1.4.20RC1 with the following text:
"All form submissions (send message, change preferences, etc.) in
SquirrelMail were previously subject to cross-site request forgery
(CSRF), wherein data could be sent to them from an offsite location,
which could allow an attacker to inject malicious content into user
preferences or possibly send emails without user consent."
To prevent your server from attacks, please use the updated SquirrelMail
package for ispCP Omega[1]. We recommend to update your SquirrelMail soon.
The original announcement can be found in the SquirrelMail homepage[2].
[1]
https://sourceforge.net/projects/ispcp/files/ispCP%20Omega/ispCP%20Omega%201.0.0/ispcp-squirrelmail-1.4.20rc1.tar.gz/download
[2] http://www.squirrelmail.org/security/issue/2009-08-12
Best Regards
Benedikt Heintel
ispCP Omega Projekt Manager