Important SquirrelMail update (CVE-2017-7692)

[wattie]

DA uses snapshot 20150507_0200 of squirrelmail. Please note that there is a (few months old) security update for CVE-2017-7692

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7692

Any snapshot older than 20170427_0200-SVN should be vulnerable.

Please update your SquirrelMail installations to the latest snapshot version.

 

[wattie]

This is the imporant file:

https://sourceforge.net/p/squirrelm...mail/class/deliver/Deliver_SendMail.class.php

I am not sure if DA installations are affected at all (they may not use SendMail but SMTP instead?); however it is still good to have that vulnerability fixed. Despite that, there is a newer than the DA revision (from 2015-11-30) which adds StartTLS support when using SMTP (here: https://sourceforge.net/p/squirrelmail/code/14530/#diff-1)...

 

[DirectAdmin Support]

Thanks, updated SquirrelMail to the latest SVN version which uses the squirrelmail_svn entry in the versions.txt.
With CustomBuild 2.0, if you have php 5.4 or higher, then you'll automatically be using the 1.4.23 SVN "stable" branch.
With CustomBuild 2.0, if you ahve php 5.3, then you'll be using the last 1.4.23 release which is not recommended.

If you are running php 5.3, please note it's very much reached end-of-life, and should not be used.
The same goes for php 5.4 and 5.5 which are no longer getting any security fixes.
Php 5.6 seems to be the most used, but is only getting security fixes at this time.
http://php.net/supported-versions.php

John