FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2008-3663

This CVE name corresponds to:

Entered	Topic
2008-09-23	squirrelmail -- Session hijacking vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2008-3663 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2008-3663
Phase	Assigned(20080812)

Description

Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

References

Source	Reference
BUGTRAQ	20080922 Squirrelmail: Session hijacking vulnerability, CVE-2008-3663
MISC	http://int21.de/cve/CVE-2008-3663-squirrelmail.html
CONFIRM	http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html
CONFIRM	http://support.apple.com/kb/HT3438
APPLE	APPLE-SA-2009-02-12
SUSE	SUSE-SR:2008:028
SUSE	SUSE-SR:2009:004
BID	31321
OVAL	oval:org.mitre.oval:def:10548
SECUNIA	33937
SREASON	4304
XF	squirrelmail-cookie-session-hijacking(45700)