6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
0.006 Low
EPSS
Percentile
75.3%
SquirrelMail is an easy-to-configure, standards-based, webmail package
written in PHP. It includes built-in PHP support for the IMAP and SMTP
protocols, and pure HTML 4.0 page-rendering (with no JavaScript required)
for maximum browser-compatibility, strong MIME support, address books, and
folder manipulation.
The Red Hat SquirrelMail packages provided by the RHSA-2009:0010 advisory
introduced a session handling flaw. Users who logged back into SquirrelMail
without restarting their web browsers were assigned fixed session
identifiers. A remote attacker could make use of that flaw to hijack user
sessions. (CVE-2009-0030)
SquirrelMail users should upgrade to this updated package, which contains a
patch to correct this issue. As well, all users who used affected versions
of SquirrelMail should review their preferences.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
RedHat | 4 | src | squirrelmail | <ย 1.4.8-5.el4_7.3 | squirrelmail-1.4.8-5.el4_7.3.src.rpm |
RedHat | 4 | noarch | squirrelmail | <ย 1.4.8-5.el4_7.3 | squirrelmail-1.4.8-5.el4_7.3.noarch.rpm |
RedHat | 5 | src | squirrelmail | <ย 1.4.8-5.el5_2.3 | squirrelmail-1.4.8-5.el5_2.3.src.rpm |
RedHat | 5 | noarch | squirrelmail | <ย 1.4.8-5.el5_2.3 | squirrelmail-1.4.8-5.el5_2.3.noarch.rpm |