CVE:CVE-2007-3634
CNNVD:CNNVD-200707-142
Squirrelmail 1.4.10a版本的G/PGP (GPG)插件2.0中存在未明漏洞。远程验证用户可以借助未明向量,且该向量可能与gpg_sign_attachment函数中的passphrase自变量相关，以执行任意指令。
solution:Upgrade squirrelmail gpg_plugin to a higher version than 2.0,and avoid the version 2.0