PT-2008-5028 · Squirrelmail+1 · Squirrelmail+1

Hanno Boeck · Publicado 2008-09-24 · Atualizado 2018-10-11 · CVE-2008-3663

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squirrelmail version 1.4.15

Description The issue is related to the session cookie in https sessions. Specifically, the secure flag is not set for the session cookie, which can cause the cookie to be sent in http requests. This makes it easier for remote attackers to capture the cookie.

Recommendations For Squirrelmail version 1.4.15, consider updating to a version that sets the secure flag for the session cookie in https sessions to prevent the cookie from being sent in http requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-3663

RHSA-2009:0010

RHSA-2009_0010

Produtos afetados

Red Hat

Squirrelmail

Referências · 17

• https://access.redhat.com/errata/RHSA-2009:0010 · Nota
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Aviso do Fabricante
• http://int21.de/cve/CVE-2008-3663-squirrelmail.html · Nota
• http://securityreason.com/securityalert/4304 · Nota
• https://access.redhat.com/security/cve/CVE-2008-2379 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3663 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3663 · Nota de Segurança
• http://nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html · Aviso do Fabricante
• http://securityfocus.com/bid/31321 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45700 · Nota
• http://securityfocus.com/archive/1/496601/100/0/threaded · Nota
• http://secunia.com/advisories/33937 · Nota
• https://access.redhat.com/security/cve/CVE-2008-3663 · Nota