CVE-2024-57643

What it actually does

The flaw in the box_deserialize_string component permits crafted SQL statements to trigger uncontrolled deserialization, resulting in application crash or resource exhaustion.

Why it matters to the business

Successful exploitation can cause extended downtime for email services on legacy Red Hat Enterprise Linux deployments, interrupting user access and requiring emergency remediation.

How an attack unfolds

An attacker sends specially constructed SQL statements to the vulnerable SquirrelMail installation; the malformed input reaches the deserialization routine and forces the process to terminate or hang.

How to fix it

Upgrade SquirrelMail to the fixed package versions: 1.4.8-16.el3 on RHEL 3, 1.4.8-5.el4_8.8 on RHEL 4, and 1.4.8-5.el5_4.10 on RHEL 5. Remove or isolate any unpatched instances.

How to confirm the fix worked

Confirm the installed RPM versions match the fixed releases above, then attempt reproduction of the original crafted-SQL test case to verify the denial-of-service condition is eliminated.

Typical attack path

1. Locate publicly reachable SquirrelMail instances on supported Red Hat Enterprise Linux releases
2. Prepare SQL input that triggers the deserialization flaw
3. Submit the payload through the webmail interface or database query path
4. Confirm service unavailability or repeated crashes

How to detect it

Review web server and application logs for repeated crashes or error messages coinciding with unusual SQL submissions; correlate with SquirrelMail process terminations.

What your security team should do

• Apply the listed package updates on all affected RHEL 3/4/5 systems without delay
• Disable or firewall SquirrelMail services that cannot be immediately updated
• Add web-application firewall rules to block anomalous SQL patterns targeting the mail interface