PT-2008-5028 · Squirrelmail+1 · Squirrelmail+1

Hanno Boeck · Published 2008-09-24 · Updated 2018-10-11 · CVE-2008-3663

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Squirrelmail version 1.4.15

Description The issue is related to the session cookie in https sessions. Specifically, the secure flag is not set for the session cookie, which can cause the cookie to be sent in http requests. This makes it easier for remote attackers to capture the cookie.

Recommendations For Squirrelmail version 1.4.15, consider updating to a version that sets the secure flag for the session cookie in https sessions to prevent the cookie from being sent in http requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-3663

RHSA-2009:0010

RHSA-2009_0010

Affected Products

Red Hat

Squirrelmail

References · 17

• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3663 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2009:0010 · Note
• http://int21.de/cve/CVE-2008-3663-squirrelmail.html · Note
• http://securityreason.com/securityalert/4304 · Note
• https://access.redhat.com/security/cve/CVE-2008-2379 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3663 · Note
• http://nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html · Note
• http://securityfocus.com/bid/31321 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45700 · Note
• http://securityfocus.com/archive/1/496601/100/0/threaded · Note
• http://secunia.com/advisories/33937 · Note
• https://access.redhat.com/security/cve/CVE-2008-3663 · Note