Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-0030 | First vendor Publication | 2009-01-21 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0030 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-287 | Improper Authentication |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10366 | |||
| Oval ID: | oval:org.mitre.oval:def:10366 | ||
| Title: | A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663. | ||
| Description: | A certain Red Hat patch for SquirrelMail 1.4.8 sets the same SQMSESSID cookie value for all sessions, which allows remote authenticated users to access other users' folder lists and configuration data in opportunistic circumstances by using the standard webmail.php interface. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-3663. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2009-0030 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-08-09 | Name : CentOS Update for squirrelmail CESA-2009:0057 centos3 i386 File : nvt/gb_CESA-2009_0057_squirrelmail_centos3_i386.nasl |
| 2011-08-09 | Name : CentOS Update for squirrelmail CESA-2009:0057 centos4 i386 File : nvt/gb_CESA-2009_0057_squirrelmail_centos4_i386.nasl |
| 2011-08-09 | Name : CentOS Update for squirrelmail CESA-2009:0057 centos5 i386 File : nvt/gb_CESA-2009_0057_squirrelmail_centos5_i386.nasl |
| 2009-02-18 | Name : SuSE Security Summary SUSE-SR:2009:004 File : nvt/suse_sr_2009_004.nasl |
| 2009-01-20 | Name : RedHat Security Advisory RHSA-2009:0057 File : nvt/RHSA_2009_0057.nasl |
| 2009-01-20 | Name : CentOS Security Advisory CESA-2009:0057 (squirrelmail) File : nvt/ovcesa2009_0057.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 51537 | SquirrelMail on Red Hat Global SQMSESSID Cookie Arbitrary Session Access |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2009-0057.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20090119_squirrelmail_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2009-10-20 | Name : The remote SuSE system is missing the security patch firefox35upgrade-6562 File : suse_firefox35upgrade-6562.nasl - Type : ACT_GATHER_INFO |
| 2009-02-05 | Name : The remote openSUSE host is missing a security update. File : suse_squirrelmail-5978.nasl - Type : ACT_GATHER_INFO |
| 2009-01-20 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2009-0057.nasl - Type : ACT_GATHER_INFO |
| 2009-01-20 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2009-0057.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:12:27 |
|
| 2024-11-28 12:18:01 |
|
| 2023-11-07 21:47:46 |
|
| 2023-02-13 09:29:21 |
|
| 2021-05-04 12:08:58 |
|
| 2021-04-22 01:09:18 |
|
| 2020-05-23 00:23:11 |
|
| 2017-09-29 09:24:00 |
|
| 2017-08-08 09:24:38 |
|
| 2016-04-26 18:32:34 |
|
| 2014-02-17 10:48:11 |
|
| 2013-05-10 23:41:30 |
|
