CVE-2009-1579

Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7

Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. This is due to a problem in the map yp alias function in functions/imap general.php.

Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting the input for the username string to prevent the use of shell metacharacters until a patch is available.