CVE-2010-1637
published 2010-06-22CVE-2010-1637: The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
2.68%
84.2th percentile
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | < 10.6.8 | 10.6.8 |
| apple | mac_os_x_server | < 10.6.8 | 10.6.8 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| squirrelmail | squirrelmail | <= 1.4.20 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
vendor_redhat·2010-05-20·CVSS 6.5
CVE-2010-1637 [MEDIUM] SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
Statement: The Red Hat Security Response Team has rated this issue as having low
security impact, a future update may address this flaw.
GHSA
GHSA-79mr-p6x2-hw9g: The Mail Fetch plugin in SquirrelMail 1
ghsa_unreviewed·2022-05-17
CVE-2010-1637 [MEDIUM] CWE-918 GHSA-79mr-p6x2-hw9g: The Mail Fetch plugin in SquirrelMail 1
The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
bugzilla·2010-06-21·CVSS 6.5
CVE-2010-1637 [MEDIUM] CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports
TEHTRI-Security reported:
[1] http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69
a deficiency in the way SquirrelMail's Mail Fetch plugin retrieved
user's electronic mail from POP3 servers using non-standard port numbers.
An authenticated, remote user could use this flaw to conduct port-scan
attacks, potentially leading to disclosure of the network typography
(DNS scan) and information about available services (port scan), when
this information was intended to be protected by firewall.
Issue severity note:
This flaw to be successfully exploited requires:
a, the SquirrelMail Mail Fetch plug-in to
Bugzilla
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports [fedora-all]
bugzilla·2010-06-21·CVSS 6.5
CVE-2010-1637 [MEDIUM] CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports [fedora-all]
CVE-2010-1637 SquirrelMail: Mail Fetch plugin -- port-scans via non-standard POP3 server ports [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
Forr more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=606459
Please
CWE
Unintended Proxy or Intermediary ('Confused Deputy')
mitre_cwe
CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
If an attacker cannot directly contact a target, but the product has access to the target, then the attacker can send a request to the product and have it be forwarded to the target. The request would appear to be coming from the product's system, not the attacker's system. As a result, the attacke
CWE
Server-Side Request Forgery (SSRF)
mitre_cwe
CWE-918 Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Application Data.
Scope: Integrity. Impact: Execute Unauthorized Code or Commands.
Scope: Access Control. Impact: Bypass Protection Mechanism. By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy
http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0103.htmlhttp://secunia.com/advisories/40307http://squirrelmail.org/security/issue/2010-06-21http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/functions.php?r1=13951&r2=13950&pathrev=13951http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/options.php?r1=13951&r2=13950&pathrev=13951http://support.apple.com/kb/HT5130http://www.mandriva.com/security/advisories?name=MDVSA-2010:120http://www.openwall.com/lists/oss-security/2010/05/25/3http://www.openwall.com/lists/oss-security/2010/05/25/9http://www.openwall.com/lists/oss-security/2010/06/21/1http://www.securityfocus.com/bid/40291http://www.securityfocus.com/bid/40307http://www.vupen.com/english/advisories/2010/1535http://www.vupen.com/english/advisories/2010/1536http://www.vupen.com/english/advisories/2010/1554http://conference.hitb.org/hitbsecconf2010dxb/materials/D1%20-%20Laurent%20Oudot%20-%20Improving%20the%20Stealthiness%20of%20Web%20Hacking.pdf#page=69http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043239.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043258.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-June/043261.htmlhttp://rhn.redhat.com/errata/RHSA-2012-0103.htmlhttp://secunia.com/advisories/40307http://squirrelmail.org/security/issue/2010-06-21http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/functions.php?r1=13951&r2=13950&pathrev=13951http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail/branches/SM-1_4-STABLE/squirrelmail/plugins/mail_fetch/options.php?r1=13951&r2=13950&pathrev=13951http://support.apple.com/kb/HT5130http://www.mandriva.com/security/advisories?name=MDVSA-2010:120http://www.openwall.com/lists/oss-security/2010/05/25/3http://www.openwall.com/lists/oss-security/2010/05/25/9http://www.openwall.com/lists/oss-security/2010/06/21/1http://www.securityfocus.com/bid/40291http://www.securityfocus.com/bid/40307http://www.vupen.com/english/advisories/2010/1535http://www.vupen.com/english/advisories/2010/1536http://www.vupen.com/english/advisories/2010/1554
2010-06-22
Published