Debian: 2091-1: squirrelmail: No user-specific token impl


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) Debian: 2091-1: squirrelmail: No user-specific token impl
# 1  
Old 08-13-2010
Debian: 2091-1: squirrelmail: No user-specific token impl

LinuxSecurity.com: SquirrelMail, a webmail application, does not employ a user-specific token for webforms. This allows a remote attacker to perform a Cross Site Request Forgery (CSRF) attack. The attacker may hijack the authentication of unspecified victims and send messages or change user preferences among other [More...]

More...
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Restart debian server if one specific process has more than 10 seconds have high cpu load

Hi, could someone give me an example for a debian server script? I need to check a process if the process has a high cpu load (top). If yes the whole server needs to reboot. Thats it, nothing more. ;) Hope someone could help me. Regards woisch (2 Replies)
Discussion started by: woisch
2 Replies

2. UNIX for Advanced & Expert Users

allow user to use sudo cp on a specific directory and only a specific file

Is there a way to allow a user to use sudo cp on a specific directory and only a specific file? (6 Replies)
Discussion started by: cokedude
6 Replies

3. UNIX for Advanced & Expert Users

PPTP authentication via Debian user accounts

I've set up pptp vpn on Debian. Works fine. User authentication is made base on file /etc/ppp/chap-secrets. I'm looking for option that user authentication in pptp would be made base on debian system users accounts or samba accounts at last. Ther's no clue on google or forums so I decided to... (1 Reply)
Discussion started by: uselab
1 Replies

4. UNIX and Linux Applications

squirrelmail login problems

Hi, I configured a mail server and I'm trying to configure webmail also but i get some errors when i login to the site. mail.log Feb 28 03:26:56 mail imapd: Connection, ip= Feb 28 03:27:33 mail imapd: Connection, ip= Feb 28 03:27:33 mail imapd: LOGIN FAILED, user=jeroen@local.nl,... (0 Replies)
Discussion started by: jld
0 Replies

5. Red Hat

Squirrelmail Configuration

Hi all, please help me out i want to configure squirrelmail in RHEL 5 ( i have configured sendmail on the same server) plz tell me the ways to confiigure it,Pre-requisite 1) via rpm 2) via package i am pretty confused by the document on the internet which to apply.plz help me out . (1 Reply)
Discussion started by: saurabh84g
1 Replies

6. Red Hat

Squirrelmail Rhel5

Hi , I am trying for squirrelmail In Rhel 5 I have the Image of the DVD .But in that I can't Find the squirrelmail-1.4.2-1.noarch.rpm And i downloaded the same but it is not working . can anyone can give any link to download the same for Rhel5.?? Thanks (1 Reply)
Discussion started by: saurabh84g
1 Replies
Login or Register to Ask a Question
PAM_CHAUTHTOK(3)						 Linux-PAM Manual						  PAM_CHAUTHTOK(3)

NAME
pam_chauthtok - updating authentication tokens SYNOPSIS
#include <security/pam_appl.h> int pam_chauthtok(pam_handle_t *pamh, int flags); DESCRIPTION
The pam_chauthtok function is used to change the authentication token for a given user (as indicated by the state associated with the handle pamh). The pamh argument is an authentication handle obtained by a prior call to pam_start(). The flags argument is the binary or of zero or more of the following values: PAM_SILENT Do not emit any messages. PAM_CHANGE_EXPIRED_AUTHTOK This argument indicates to the modules that the users authentication token (password) should only be changed if it has expired. If this argument is not passed, the application requires that all authentication tokens are to be changed. RETURN VALUES
PAM_AUTHTOK_ERR A module was unable to obtain the new authentication token. PAM_AUTHTOK_RECOVERY_ERR A module was unable to obtain the old authentication token. PAM_AUTHTOK_LOCK_BUSY One or more of the modules was unable to change the authentication token since it is currently locked. PAM_AUTHTOK_DISABLE_AGING Authentication token aging has been disabled for at least one of the modules. PAM_PERM_DENIED Permission denied. PAM_SUCCESS The authentication token was successfully updated. PAM_TRY_AGAIN Not all of the modules were in a position to update the authentication token(s). In such a case none of the user's authentication tokens are updated. PAM_USER_UNKNOWN User unknown to password service. SEE ALSO
pam_start(3), pam_authenticate(3), pam_setcred(3), pam_get_item(3), pam_strerror(3), pam(7) Linux-PAM Manual 06/04/2011 PAM_CHAUTHTOK(3)