CVE-2007-3634 Command injection in n/a

Medium 6.5 Published 10 Jul 2007 Updated 7 Aug 2024

Remote authenticated users can execute arbitrary commands via the GPG plugin for SquirrelMail, posing a significant risk to email server integrity.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2007-3634?

CVE-2007-3634 is a medium-severity command injection vulnerability in n/a, published on 10 Jul 2007. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Unspecified vulnerability in the G/PGP (GPG) Plugin 2.0 for Squirrelmail 1.4.10a allows remote authenticated users to execute arbitrary commands via unspecified vectors, possibly related to the passphrase variable in the gpg_sign_attachment function, aka ZD-00000004. this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.

Which versions are affected by CVE-2007-3634?

It affects 1 product.

Products include Squirrelmail Gpg Plugin.

How do I fix CVE-2007-3634?

No fix has been published for CVE-2007-3634 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2007-3634 being exploited?

There is no known exploitation of CVE-2007-3634 in the wild and no public exploit code.

Sources

Also known as GHSA-884p-rv7w-x8h6.