[ MDVSA-2009:053 ] squirrelmail

[dude67]

_______________________________________________________________________

Package : squirrelmail
Date : February 24, 2009
Affected: Corporate 4.0
_______________________________________________________________________

Problem Description:

A vulnerability has been identified and corrected in squirrelmail:

Squirrelmail 1.4.15 does not set the secure flag for the session
cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie (CVE-2008-3663).

Additionally many of the bundled plugins has been upgraded. The
localization has also been upgraded. Basically this is a syncronization
with the latest squirrelmail package found in Mandriva Cooker. The
rpm changelog will reveal all the changes (rpm -q --changelog
squirrelmail).

The updated packages have been upgraded to the latest version of
squirrelmail to prevent this.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2008-3663
_______________________________________________________________________