SquirrelMail Insecure Cookie Disclosure Weakness
BID:31321
Info
SquirrelMail Insecure Cookie Disclosure Weakness
| Bugtraq ID: | 31321 |
| Class: | Design Error |
| CVE: |
CVE-2008-3663 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 23 2008 12:00AM |
| Updated: | Apr 13 2015 10:20PM |
| Credit: | Hanno Boeck |
| Vulnerable: |
SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SquirrelMail SquirrelMail 1.4.15 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 NaSMail NaSMail 0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 |
| Not Vulnerable: |
NaSMail NaSMail 1.6 |
Discussion
SquirrelMail Insecure Cookie Disclosure Weakness
SquirrelMail is prone to a cookie-disclosure weakness.
An attacker may leverage this issue to obtain sensitive information, steal cookie-based authentication credentials, and carry out session-hijacking attacks; other attacks are also possible.
SquirrelMail 1.4.15 is vulnerable; other versions may also be affected.
SquirrelMail is prone to a cookie-disclosure weakness.
An attacker may leverage this issue to obtain sensitive information, steal cookie-based authentication credentials, and carry out session-hijacking attacks; other attacks are also possible.
SquirrelMail 1.4.15 is vulnerable; other versions may also be affected.
Exploit / POC
SquirrelMail Insecure Cookie Disclosure Weakness
An attacker can exploit the issue by using readily available network sniffers.
An attacker can exploit the issue by using readily available network sniffers.
Solution / Fix
SquirrelMail Insecure Cookie Disclosure Weakness
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Corporate Server 4.0
MandrakeSoft Corporate Server 4.0 x86_64
Solution:
Updates are available. Please see the references for more information.
MandrakeSoft Corporate Server 4.0
-
Mandriva squirrelmail-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ar-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-bg-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-bn-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ca-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cs-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cy-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cyrus-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-da-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-de-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-el-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-en-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-es-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-et-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-eu-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fa-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fi-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fo-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fy-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-he-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-hr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-hu-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-id-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-is-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-it-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ja-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ka-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ko-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-lt-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ms-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nb-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nn-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-pl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-poutils-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-pt-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ro-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ru-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sk-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sv-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-th-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-tr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ug-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-uk-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-vi-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-zh_CN-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-zh_TW-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
MandrakeSoft Corporate Server 4.0 x86_64
-
Mandriva squirrelmail-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ar-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-bg-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-bn-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ca-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cs-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cy-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-cyrus-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-da-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-de-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-el-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-en-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-es-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-et-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-eu-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fa-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fi-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fo-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-fy-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-he-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-hr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-hu-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-id-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-is-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-it-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ja-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ka-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ko-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-lt-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ms-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nb-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-nn-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-pl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-poutils-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-pt-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ro-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ru-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sk-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sl-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-sv-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-th-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-tr-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-ug-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-uk-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-vi-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-zh_CN-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/ -
Mandriva squirrelmail-zh_TW-1.4.17-0.1.20060mlcs4.noarch.rpm
http://www.mandriva.com/en/download/
References
SquirrelMail Insecure Cookie Disclosure Weakness
References:
References:
- NaSMail Homepage (NaSMail)
- SquirrelMail Homepage (SquirrelMail)
- Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 (Hanno Boeck)
- Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 (Hanno Boeck)