To: [email protected]Subject: [ MDVSA-2009:053 ] squirrelmail
Date: Tue, 24 Feb 2009 22:05:00 +0100
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1Lc4Sb-00076H-1Y@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:053
http://www.mandriva.com/security/
_______________________________________________________________________
Package : squirrelmail
Date : February 24, 2009
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
A vulnerability has been identified and corrected in squirrelmail:
Squirrelmail 1.4.15 does not set the secure flag for the session
cookie in an https session, which can cause the cookie to be sent in
http requests and make it easier for remote attackers to capture this
cookie (CVE-2008-3663).
Additionally many of the bundled plugins has been upgraded. The
localization has also been upgraded. Basically this is a syncronization
with the latest squirrelmail package found in Mandriva Cooker. The
rpm changelog will reveal all the changes (rpm -q --changelog
squirrelmail).
The updated packages have been upgraded to the latest version of
squirrelmail to prevent this.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3663
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
95cf03be6e7b2473ce9a0b5a1367bae2 corporate/4.0/i586/squirrelmail-1.4.17-0.1.20060mlcs4.noarch.rpm
48ad051dd66c37855aa3fb6c2cbc20f7 corporate/4.0/i586/squirrelmail-ar-1.4.17-0.1.20060mlcs4.noarch.rpm
74fb0e0b4cb0acfc6cb44ca2a93a4b97 corporate/4.0/i586/squirrelmail-bg-1.4.17-0.1.20060mlcs4.noarch.rpm
d222212f2234962f8ca4e66c156b37da corporate/4.0/i586/squirrelmail-bn-1.4.17-0.1.20060mlcs4.noarch.rpm
8980f21c82a249247b920f1e4cfcca4f corporate/4.0/i586/squirrelmail-ca-1.4.17-0.1.20060mlcs4.noarch.rpm
3c0e44566b306403dd521eb38bf07c1d corporate/4.0/i586/squirrelmail-cs-1.4.17-0.1.20060mlcs4.noarch.rpm
d14219415c953cc4ea76ac8ebbc66a52 corporate/4.0/i586/squirrelmail-cy-1.4.17-0.1.20060mlcs4.noarch.rpm
a69de36da8dd2f34dd8d37c80c2c4921 corporate/4.0/i586/squirrelmail-cyrus-1.4.17-0.1.20060mlcs4.noarch.rpm
7849df3760134a094993b05a51b92ae4 corporate/4.0/i586/squirrelmail-da-1.4.17-0.1.20060mlcs4.noarch.rpm
c70a008e5665906adf5002eb60792125 corporate/4.0/i586/squirrelmail-de-1.4.17-0.1.20060mlcs4.noarch.rpm
cf72c9ca4d3bd83f2e7167d6282af3ab corporate/4.0/i586/squirrelmail-el-1.4.17-0.1.20060mlcs4.noarch.rpm
1874b68127cffe0634ed9deae3dd1274 corporate/4.0/i586/squirrelmail-en-1.4.17-0.1.20060mlcs4.noarch.rpm
f6b39e384b632b4e3de4e8bf26d8fa15 corporate/4.0/i586/squirrelmail-es-1.4.17-0.1.20060mlcs4.noarch.rpm
4c696de6f338592193741e1bbc76bf29 corporate/4.0/i586/squirrelmail-et-1.4.17-0.1.20060mlcs4.noarch.rpm
0642590bd9d9dc51e83bfd312b4fb9b4 corporate/4.0/i586/squirrelmail-eu-1.4.17-0.1.20060mlcs4.noarch.rpm
3b36ab450803e6af544d4d4f7fe44669 corporate/4.0/i586/squirrelmail-fa-1.4.17-0.1.20060mlcs4.noarch.rpm
ccb3971fb245acc430b4142423d836ad corporate/4.0/i586/squirrelmail-fi-1.4.17-0.1.20060mlcs4.noarch.rpm
fce50af8c6358c90609efd5bfd6cb9c7 corporate/4.0/i586/squirrelmail-fo-1.4.17-0.1.20060mlcs4.noarch.rpm
27dcca136f22dcd2380162d997786c0c corporate/4.0/i586/squirrelmail-fr-1.4.17-0.1.20060mlcs4.noarch.rpm
6749520ef18e97c7e1a012a0b8788283 corporate/4.0/i586/squirrelmail-fy-1.4.17-0.1.20060mlcs4.noarch.rpm
120d7de4c1803077be58457bd3915cfb corporate/4.0/i586/squirrelmail-he-1.4.17-0.1.20060mlcs4.noarch.rpm
6ce9336b4e1886d3b3b788e60741fba9 corporate/4.0/i586/squirrelmail-hr-1.4.17-0.1.20060mlcs4.noarch.rpm
34410baa68c8242a55ecaed98b2a2ba3 corporate/4.0/i586/squirrelmail-hu-1.4.17-0.1.20060mlcs4.noarch.rpm
086d7d245a07bbd1b4f505bc7e472bf5 corporate/4.0/i586/squirrelmail-id-1.4.17-0.1.20060mlcs4.noarch.rpm
a66caff93eb9f08d77dff47d3ae5c095 corporate/4.0/i586/squirrelmail-is-1.4.17-0.1.20060mlcs4.noarch.rpm
327c9e879d151c47a49e55db9f43cec0 corporate/4.0/i586/squirrelmail-it-1.4.17-0.1.20060mlcs4.noarch.rpm
17861b881b7aa57ce4ca9f2765c0546c corporate/4.0/i586/squirrelmail-ja-1.4.17-0.1.20060mlcs4.noarch.rpm
09279a8560e542523a32c983f13e7097 corporate/4.0/i586/squirrelmail-ka-1.4.17-0.1.20060mlcs4.noarch.rpm
0ca6370e0123ab26751968cdfdb8ed4a corporate/4.0/i586/squirrelmail-ko-1.4.17-0.1.20060mlcs4.noarch.rpm
3722d115be357f977771d0cf5d6835eb corporate/4.0/i586/squirrelmail-lt-1.4.17-0.1.20060mlcs4.noarch.rpm
d4895ada8778c74bd802107dc60ddc34 corporate/4.0/i586/squirrelmail-ms-1.4.17-0.1.20060mlcs4.noarch.rpm
e6c7702f13621939332eff915c577a25 corporate/4.0/i586/squirrelmail-nb-1.4.17-0.1.20060mlcs4.noarch.rpm
be02fc2b9c7f38832717a640f51948c0 corporate/4.0/i586/squirrelmail-nl-1.4.17-0.1.20060mlcs4.noarch.rpm
44be9d366b1cf2fc1851921309e932b5 corporate/4.0/i586/squirrelmail-nn-1.4.17-0.1.20060mlcs4.noarch.rpm
d55ee89dc3ccb24300fb244511b3c12f corporate/4.0/i586/squirrelmail-pl-1.4.17-0.1.20060mlcs4.noarch.rpm
76e2c8410bcad887533a39cd47bd7b7c corporate/4.0/i586/squirrelmail-poutils-1.4.17-0.1.20060mlcs4.noarch.rpm
3810039b267b21627bbaf0cea4866121 corporate/4.0/i586/squirrelmail-pt-1.4.17-0.1.20060mlcs4.noarch.rpm
e1d6c22111fa3f391f150a906ca90297 corporate/4.0/i586/squirrelmail-ro-1.4.17-0.1.20060mlcs4.noarch.rpm
551417519f6fc6328d18dee99ef3e688 corporate/4.0/i586/squirrelmail-ru-1.4.17-0.1.20060mlcs4.noarch.rpm
5f89f9f664fa272ab5eb09758d15e4ab corporate/4.0/i586/squirrelmail-sk-1.4.17-0.1.20060mlcs4.noarch.rpm
ed1fa76c7eeb136a972bb512c89c0d20 corporate/4.0/i586/squirrelmail-sl-1.4.17-0.1.20060mlcs4.noarch.rpm
dc1d7563d4b3f90be2fd65a1b3f1ccbe corporate/4.0/i586/squirrelmail-sr-1.4.17-0.1.20060mlcs4.noarch.rpm
9603483d42484083c30321112b17381e corporate/4.0/i586/squirrelmail-sv-1.4.17-0.1.20060mlcs4.noarch.rpm
e958148672aeba7dc9fc7973c068a2e5 corporate/4.0/i586/squirrelmail-th-1.4.17-0.1.20060mlcs4.noarch.rpm
b4def8e3eb06e5e7ac77dfcc22b71ad0 corporate/4.0/i586/squirrelmail-tr-1.4.17-0.1.20060mlcs4.noarch.rpm
adddb115aa7e5fd2ce574853a36994a3 corporate/4.0/i586/squirrelmail-ug-1.4.17-0.1.20060mlcs4.noarch.rpm
a53114b6941cf3f89fa0eaeae27d4bc8 corporate/4.0/i586/squirrelmail-uk-1.4.17-0.1.20060mlcs4.noarch.rpm
822cde1f3bf902ecb9abbe258519e900 corporate/4.0/i586/squirrelmail-vi-1.4.17-0.1.20060mlcs4.noarch.rpm
72bf98850b16465e51c37ec5a9db11b5 corporate/4.0/i586/squirrelmail-zh_CN-1.4.17-0.1.20060mlcs4.noarch.rpm
0809e8c6c39fbe5876826f95af840422 corporate/4.0/i586/squirrelmail-zh_TW-1.4.17-0.1.20060mlcs4.noarch.rpm
3b73c9fa245ff0f4b0a499a57734b206 corporate/4.0/SRPMS/squirrelmail-1.4.17-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
f3280de8c12c7ae65a33d2f688089629 corporate/4.0/x86_64/squirrelmail-1.4.17-0.1.20060mlcs4.noarch.rpm
fa1772d2fb8b956c1614213016d3ad2f corporate/4.0/x86_64/squirrelmail-ar-1.4.17-0.1.20060mlcs4.noarch.rpm
e5764853ee1ac844d2a14227811f756b corporate/4.0/x86_64/squirrelmail-bg-1.4.17-0.1.20060mlcs4.noarch.rpm
068e23a40e2e427262d066f8d936395a corporate/4.0/x86_64/squirrelmail-bn-1.4.17-0.1.20060mlcs4.noarch.rpm
292a1737117c10a1f1d1043d4a51428a corporate/4.0/x86_64/squirrelmail-ca-1.4.17-0.1.20060mlcs4.noarch.rpm
5b839c4a195512a53cd221ac4baa8d06 corporate/4.0/x86_64/squirrelmail-cs-1.4.17-0.1.20060mlcs4.noarch.rpm
a5a9bf409eee0ee254ebbb7001a76378 corporate/4.0/x86_64/squirrelmail-cy-1.4.17-0.1.20060mlcs4.noarch.rpm
def9e8790daa459442c0d508505aaaed corporate/4.0/x86_64/squirrelmail-cyrus-1.4.17-0.1.20060mlcs4.noarch.rpm
000185f344e00635757554fe8bd18ddf corporate/4.0/x86_64/squirrelmail-da-1.4.17-0.1.20060mlcs4.noarch.rpm
8c7be1bc423c4f696255d9f415e48afc corporate/4.0/x86_64/squirrelmail-de-1.4.17-0.1.20060mlcs4.noarch.rpm
8c35e51637e8b59fd78b41761d8692d3 corporate/4.0/x86_64/squirrelmail-el-1.4.17-0.1.20060mlcs4.noarch.rpm
c14478a63e3e0987a37dd544d7aa2321 corporate/4.0/x86_64/squirrelmail-en-1.4.17-0.1.20060mlcs4.noarch.rpm
c519e263503c63835158ad681328eb4f corporate/4.0/x86_64/squirrelmail-es-1.4.17-0.1.20060mlcs4.noarch.rpm
d1196b2bbd9b594590e4443d07375d2c corporate/4.0/x86_64/squirrelmail-et-1.4.17-0.1.20060mlcs4.noarch.rpm
9984a56548e20544a7ec3a7c04a87618 corporate/4.0/x86_64/squirrelmail-eu-1.4.17-0.1.20060mlcs4.noarch.rpm
b81613ef5be414de9259e8a0df13ac1a corporate/4.0/x86_64/squirrelmail-fa-1.4.17-0.1.20060mlcs4.noarch.rpm
084e365cc0510a47a8b94d0a0910deab corporate/4.0/x86_64/squirrelmail-fi-1.4.17-0.1.20060mlcs4.noarch.rpm
16a77fb651be0671a7686998604cb56a corporate/4.0/x86_64/squirrelmail-fo-1.4.17-0.1.20060mlcs4.noarch.rpm
e00d39d149486d25489dc74f743a172c corporate/4.0/x86_64/squirrelmail-fr-1.4.17-0.1.20060mlcs4.noarch.rpm
6a2941e570de99f7f70a9ad06306bb95 corporate/4.0/x86_64/squirrelmail-fy-1.4.17-0.1.20060mlcs4.noarch.rpm
5089a3f371d061cf7d314418d74ec6c5 corporate/4.0/x86_64/squirrelmail-he-1.4.17-0.1.20060mlcs4.noarch.rpm
8a79c67035594085350ed5c01014490c corporate/4.0/x86_64/squirrelmail-hr-1.4.17-0.1.20060mlcs4.noarch.rpm
f844187c116db05adb103bccf3d28e64 corporate/4.0/x86_64/squirrelmail-hu-1.4.17-0.1.20060mlcs4.noarch.rpm
ae255f18f6043ab1fba455367e772e08 corporate/4.0/x86_64/squirrelmail-id-1.4.17-0.1.20060mlcs4.noarch.rpm
6edd501ae42ae224108cb5c5970abcec corporate/4.0/x86_64/squirrelmail-is-1.4.17-0.1.20060mlcs4.noarch.rpm
8ab4887fa775d71a4f13b53ccf39515d corporate/4.0/x86_64/squirrelmail-it-1.4.17-0.1.20060mlcs4.noarch.rpm
c902aafe8b7d9c43368ad07293e7944d corporate/4.0/x86_64/squirrelmail-ja-1.4.17-0.1.20060mlcs4.noarch.rpm
4b4e4e4466552cbd191a57fc322dcf6f corporate/4.0/x86_64/squirrelmail-ka-1.4.17-0.1.20060mlcs4.noarch.rpm
732741d18e3809b0ac3d0bbd45c6cca2 corporate/4.0/x86_64/squirrelmail-ko-1.4.17-0.1.20060mlcs4.noarch.rpm
119270b21cc6c65afdca3d87a856aff3 corporate/4.0/x86_64/squirrelmail-lt-1.4.17-0.1.20060mlcs4.noarch.rpm
1acb391634cd131d1c2025bbc6bcd565 corporate/4.0/x86_64/squirrelmail-ms-1.4.17-0.1.20060mlcs4.noarch.rpm
4b4bf405f01b66cd23c8e743f3e73467 corporate/4.0/x86_64/squirrelmail-nb-1.4.17-0.1.20060mlcs4.noarch.rpm
9ba3f11c67681fd56c20f4f7f4f8da87 corporate/4.0/x86_64/squirrelmail-nl-1.4.17-0.1.20060mlcs4.noarch.rpm
12836c4fcaff9901a6010d6d086b83a7 corporate/4.0/x86_64/squirrelmail-nn-1.4.17-0.1.20060mlcs4.noarch.rpm
09549a89a49c8575b4eea539be30299e corporate/4.0/x86_64/squirrelmail-pl-1.4.17-0.1.20060mlcs4.noarch.rpm
e621130952570623a18aeedb9ed601ee corporate/4.0/x86_64/squirrelmail-poutils-1.4.17-0.1.20060mlcs4.noarch.rpm
18fce011683b8c45dfedea86bdab0806 corporate/4.0/x86_64/squirrelmail-pt-1.4.17-0.1.20060mlcs4.noarch.rpm
1d7235de07d3ecf72c067f2e14c9242e corporate/4.0/x86_64/squirrelmail-ro-1.4.17-0.1.20060mlcs4.noarch.rpm
5bcca5a9fac90955fdc80d8cf3f377a7 corporate/4.0/x86_64/squirrelmail-ru-1.4.17-0.1.20060mlcs4.noarch.rpm
6c7d0e3e24a9d072423f27adb7952075 corporate/4.0/x86_64/squirrelmail-sk-1.4.17-0.1.20060mlcs4.noarch.rpm
2c829346fc30baa8c50113efc358c55c corporate/4.0/x86_64/squirrelmail-sl-1.4.17-0.1.20060mlcs4.noarch.rpm
88b492db17ef422d1c212e56afa1310f corporate/4.0/x86_64/squirrelmail-sr-1.4.17-0.1.20060mlcs4.noarch.rpm
baf5056d4689d5e780f7288a4aae52ed corporate/4.0/x86_64/squirrelmail-sv-1.4.17-0.1.20060mlcs4.noarch.rpm
493492b2dd7a2321b0809a5960a61c6f corporate/4.0/x86_64/squirrelmail-th-1.4.17-0.1.20060mlcs4.noarch.rpm
9213573d6ecc7a65e5256a71a3c9bf87 corporate/4.0/x86_64/squirrelmail-tr-1.4.17-0.1.20060mlcs4.noarch.rpm
66a85c60754fcec43bc94a3191e72601 corporate/4.0/x86_64/squirrelmail-ug-1.4.17-0.1.20060mlcs4.noarch.rpm
53bbb278705820e71538bdc97fdfac5b corporate/4.0/x86_64/squirrelmail-uk-1.4.17-0.1.20060mlcs4.noarch.rpm
7cbaedc9c128d3d7b0a7f2b9b40cb950 corporate/4.0/x86_64/squirrelmail-vi-1.4.17-0.1.20060mlcs4.noarch.rpm
119559074ec11e1de195513b4c4bf33e corporate/4.0/x86_64/squirrelmail-zh_CN-1.4.17-0.1.20060mlcs4.noarch.rpm
1cfa34238c7e5d45cb726ddea9d154dc corporate/4.0/x86_64/squirrelmail-zh_TW-1.4.17-0.1.20060mlcs4.noarch.rpm
3b73c9fa245ff0f4b0a499a57734b206 corporate/4.0/SRPMS/squirrelmail-1.4.17-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFJpDaUmqjQ0CJFipgRAkV0AJ0apkpCbwfBOJEWhKS7wpqgf+GuHQCg5V8e
z2xIpwRwvL8ohemkU/kuI50=
=/I9x
-----END PGP SIGNATURE-----
