Bug 500358 - (CVE-2009-1580) CVE-2009-1580 SquirrelMail: Session fixation vulnerability
CVE-2009-1580 SquirrelMail: Session fixation vulnerability
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
http://www.squirrelmail.org/security/...
reported=20090512,public=20090511,imp...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-12 08:38 EDT by Jan Lieskovsky
Modified: 2016-03-04 06:01 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-05-15 10:37:16 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2009-05-12 08:38:12 EDT
From SquirrelMail vulnerability report:

An issue was fixed that allowed an attacker to possibly steal user data by hijacking the SquirrelMail login session.

Credits: Tomas Hoger

Patch: 
http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13676
Comment 1 Fedora Update System 2009-05-12 09:07:28 EDT
squirrelmail-1.4.18-1.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/squirrelmail-1.4.18-1.fc9
Comment 2 Tomas Hoger 2009-05-12 09:23:46 EDT
This issue does not affect current squirrelmail packages shipped in Red Hat Enterprise Linux 3, 4 and 5.  Change similar to the upstream fix mentioned in comment #0 (upstream SVN r13676) was introduced via RHSA-2009:0057 (http://rhn.redhat.com/errata/RHSA-2009-0057.html) to mitigate the impact of the Red Hat-specific session management regression introduced in RHSA-2009:0010, bug #480224.  The change ensured new session id was regenerated after each successful login, and also provides protection against session fixation class of attacks.  The change has now been included in upstream SquirrelMail too.

The impact of the flaw was limited, as it required an attacker to be able to set malicious cookie on the victim's system.  Successful exploitation did not allow an attacker to get full access to the victim's mail.
Comment 3 Fedora Update System 2009-05-12 20:20:54 EDT
squirrelmail-1.4.18-1.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2009-05-12 20:22:30 EDT
squirrelmail-1.4.18-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2009-05-12 20:23:46 EDT
squirrelmail-1.4.18-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Jan Lieskovsky 2009-05-14 14:06:54 EDT
CVE-2009-1580:

Session fixation vulnerability in SquirrelMail before 1.4.18 allows
remote attackers to hijack web sessions via a crafted cookie.
Comment 7 Tomas Hoger 2009-05-15 10:37:16 EDT
Fedora updated now to 1.4.18, no further action required for Red Hat Enterprise Linux packages (see comment #2).  Closing.

Note You need to log in before you can comment on or make changes to this bug.