MEDIUM
squirrelmail: session management flaw
Published Jan 21, 2009
6.5
MEDIUMCVSS 2.0
EPSS 1.68%
Description
A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663.
Affected products
No data.
- 1.4.8
No data.
Red Hat Enterprise Linux 3
squirrelmail-0:1.4.8-9.el3
Fixed · RHSA-2009:0057
Red Hat Enterprise Linux 4
squirrelmail-0:1.4.8-5.el4_7.3
Fixed · RHSA-2009:0057
Red Hat Enterprise Linux 5
squirrelmail-0:1.4.8-5.el5_2.3
Fixed · RHSA-2009:0057
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | squirrelmail-0:1.4.8-9.el3 | Fixed | RHSA-2009:0057 |
| Red Hat Enterprise Linux 4 | squirrelmail-0:1.4.8-5.el4_7.3 | Fixed | RHSA-2009:0057 |
| Red Hat Enterprise Linux 5 | squirrelmail-0:1.4.8-5.el5_2.3 | Fixed | RHSA-2009:0057 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (12)
- http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html vendor-advisoryx_refsource_SUSE
- http://secunia.com/advisories/33611 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://securitytracker.com/id?1021611 vdb-entryx_refsource_SECTRACK
- http://www.securityfocus.com/bid/33354 vdb-entryx_refsource_BID
- https://access.redhat.com/security/cve/CVE-2009-0030 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=480224 x_refsource_CONFIRM
- https://bugzilla.redhat.com/show_bug.cgi?id=480488 x_refsource_CONFIRMIssue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48115 vdb-entryx_refsource_XF
- https://nvd.nist.gov/vuln/detail/CVE-2009-0030
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366 vdb-entrysignaturex_refsource_OVAL
- https://rhn.redhat.com/errata/RHSA-2009-0057.html vendor-advisoryx_refsource_REDHAT
- https://www.cve.org/CVERecord?id=CVE-2009-0030
| Link | Providers | Tags |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html | vendor-advisoryx_refsource_SUSE | |
| http://secunia.com/advisories/33611 | third-party-advisoryx_refsource_SECUNIAVendor Advisory | |
| http://securitytracker.com/id?1021611 | vdb-entryx_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/33354 | vdb-entryx_refsource_BID | |
| https://access.redhat.com/security/cve/CVE-2009-0030 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=480224 | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=480488 | x_refsource_CONFIRMIssue Tracking | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/48115 | vdb-entryx_refsource_XF | |
| https://nvd.nist.gov/vuln/detail/CVE-2009-0030 | ||
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10366 | vdb-entrysignaturex_refsource_OVAL | |
| https://rhn.redhat.com/errata/RHSA-2009-0057.html | vendor-advisoryx_refsource_REDHAT | |
| https://www.cve.org/CVERecord?id=CVE-2009-0030 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 21, 2009
Updated Aug 7, 2024
Reserved Dec 15, 2008
Link CVE-2009-0030
CISA Vulnrichment
Updated n/a