Lucene search
RootSSV:4796HistoryFeb 19, 2009 - 12:00 a.m.
SquirrelMail软件包会话处理绕过认证漏洞
2009-02-1900:00:00
Root
www.seebug.org
34
EPSS
0.005
Percentile
76.4%
BUGTRAQ ID: 33354
CVE(CAN) ID: CVE-2009-0030
SquirrelMail是一款PHP编写的WEBMAIL程序。
Red Hat为CVE-2008-3663所提供的修复导致SquirrelMail对所有的会话都设置了相同的SQMSESSID Cookie值，这允许通过认证的远程用户通过使用标准的webmail.php接口访问其他用户的文件夹列表和配置数据。
SquirrelMail 1.4.8
厂商补丁：
RedHat
RedHat已经为此发布了一个安全公告（RHSA-2009:0057-01）以及相应补丁:
RHSA-2009:0057-01：Important: squirrelmail security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2009-0057.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2009-0057.html</a>
Related
ubuntucve
ubuntucve
CVE-2009-0030
2009-01-21 00:00:00
CVE-2008-3663
2008-09-24 00:00:00
prion
prion
Design/Logic Flaw
2009-01-21 20:30:00
Design/Logic Flaw
2008-09-24 14:56:00
nessus
nessus
openSUSE 10 Security Update : squirrelmail (squirrelmail-5978)
2009-02-05 00:00:00
Scientific Linux Security Update : squirrelmail on SL3.x, SL4.x, SL5.x i386/x86_64
2012-08-01 00:00:00
SquirrelMail HTTPS Session Cookie Secure Flag Weakness
2009-02-12 00:00:00
cvelist
cvelist
CVE-2009-0030
2009-01-21 20:00:00
CVE-2008-3663
2008-09-24 14:00:00
nvd
nvd
CVE-2009-0030
2009-01-21 20:30:00
CVE-2008-3663
2008-09-24 14:56:52
cve
cve
CVE-2009-0030
2009-01-21 20:30:00
CVE-2008-3663
2008-09-24 14:56:52
oraclelinux
oraclelinux
squirrelmail security update
2009-01-20 00:00:00
squirrelmail security update
2009-01-12 00:00:00
openvas
openvas
Oracle: Security Advisory (ELSA-2009-0057)
2015-10-08 00:00:00
RedHat Security Advisory RHSA-2009:0057
2009-01-20 00:00:00
CentOS Update for squirrelmail CESA-2009:0057 centos5 i386
2011-08-09 00:00:00
veracode
veracode
Session Hijacking
2020-04-10 00:29:08
Information Disclosure
2020-04-10 00:36:07
fedora
fedora
[SECURITY] Fedora 9 Update: squirrelmail-1.4.16-1.fc9
2008-10-23 16:35:48
[SECURITY] Fedora 9 Update: squirrelmail-1.4.17-1.fc9
2008-12-07 04:13:16
[SECURITY] Fedora 8 Update: squirrelmail-1.4.16-1.fc8
2008-10-24 23:48:16
securityvulns
securityvulns
Squirrelmail: Session hijacking vulnerability, CVE-2008-3663
2008-09-24 00:00:00
freebsd
freebsd
squirrelmail -- Session hijacking vulnerability
2008-08-12 00:00:00
seebug
seebug
SquirrelMail不安全COOKE泄漏漏洞
2008-09-25 00:00:00
redhat
redhat
(RHSA-2009:0057) Important: squirrelmail security update
2009-01-19 00:00:00
(RHSA-2009:0010) Moderate: squirrelmail security update
2009-01-12 00:00:00
centos
centos
squirrelmail security update
2009-01-19 22:38:06
squirrelmail security update
2009-01-12 15:25:30