Description
SquirrelMail 1.4.11 and 1.4.12, as distributed on sourceforge.net before 20071213, has been externally modified to create a Trojan Horse that introduces a PHP remote file inclusion vulnerability, which allows remote attackers to execute arbitrary code.
References
- [squirrelmail-devel] 20071214 Re: [SM-DEVEL] SECURITY: 1.4.12 Package Compromise mailing-list
- 20071213 SECURITY: 1.4.12 Package Compromise mailing-list
- 20071214 ANNOUNCE: SquirrelMail 1.4.13 Released mailing-list
- 28095 third-party-advisory
- http://www.squirrelmail.org/index.php
- [squirrelmail-devel] 20071213 [SM-DEVEL] SECURITY: 1.4.12 Package Compromise mailing-list
- 42633 vdb-entry