Security Notice Phishing campain
Version 1.4.15
Security Upgrade
Security
Variable overwriting in compose.php
Date:
2006年08月11日
Description:
A logged in user could overwrite random variables in compose.php, which might make it possible to read/write other users' preferences or attachments.
The function that the bug was in, was actually broken in the latest release of SquirrelMail. Therefore the simple fix is to just remove that function entirely if you don't miss it. The patch below restores the functionality (resume a compose session when the user's session expired) and fixes the hole.
Affected Versions:
1.4.0 - 1.4.7
Register Globals:
Register_globals does not have to be on for this issue.