6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
77.6%
CentOS Errata and Security Advisory CESA-2009:0057
SquirrelMail is an easy-to-configure, standards-based, webmail package
written in PHP. It includes built-in PHP support for the IMAP and SMTP
protocols, and pure HTML 4.0 page-rendering (with no JavaScript required)
for maximum browser-compatibility, strong MIME support, address books, and
folder manipulation.
The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory
introduced a session handling flaw. Users who logged back into SquirrelMail
without restarting their web browsers were assigned fixed session
identifiers. A remote attacker could make use of that flaw to hijack user
sessions. (CVE-2009-0030)
SquirrelMail users should upgrade to this updated package, which contains a
patch to correct this issue. As well, all users who used affected versions
of SquirrelMail should review their preferences.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-January/077722.html
https://lists.centos.org/pipermail/centos-announce/2009-January/077723.html
https://lists.centos.org/pipermail/centos-announce/2009-January/077726.html
https://lists.centos.org/pipermail/centos-announce/2009-January/077727.html
https://lists.centos.org/pipermail/centos-announce/2009-January/077728.html
https://lists.centos.org/pipermail/centos-announce/2009-January/077729.html
Affected packages:
squirrelmail
Upstream details at:
https://access.redhat.com/errata/RHSA-2009:0057
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 3 | noarch | squirrelmail | <ย 1.4.8-9.el3.centos.1 | squirrelmail-1.4.8-9.el3.centos.1.noarch.rpm |
CentOS | 3 | noarch | squirrelmail | <ย 1.4.8-9.el3.centos.1 | squirrelmail-1.4.8-9.el3.centos.1.noarch.rpm |
CentOS | 3 | noarch | squirrelmail | <ย 1.4.8-9.el3.centos.1 | squirrelmail-1.4.8-9.el3.centos.1.noarch.rpm |
CentOS | 3 | noarch | squirrelmail | <ย 1.4.8-9.el3.centos.1 | squirrelmail-1.4.8-9.el3.centos.1.noarch.rpm |
CentOS | 5 | noarch | squirrelmail | <ย 1.4.8-5.el5.centos.3 | squirrelmail-1.4.8-5.el5.centos.3.noarch.rpm |
CentOS | 5 | noarch | squirrelmail | <ย 1.4.8-5.el5.centos.3 | squirrelmail-1.4.8-5.el5.centos.3.noarch.rpm |
CentOS | 5 | noarch | squirrelmail | <ย 1.4.8-5.el5.centos.3 | squirrelmail-1.4.8-5.el5.centos.3.noarch.rpm |
CentOS | 5 | noarch | squirrelmail | <ย 1.4.8-5.el5.centos.3 | squirrelmail-1.4.8-5.el5.centos.3.noarch.rpm |
CentOS | 4 | noarch | squirrelmail | <ย 1.4.8-5.el4.centos.3 | squirrelmail-1.4.8-5.el4.centos.3.noarch.rpm |
CentOS | 4 | noarch | squirrelmail | <ย 1.4.8-5.el4.centos.3 | squirrelmail-1.4.8-5.el4.centos.3.noarch.rpm |