Description
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squirrelmail | 1.4.8-5.el5_2.2 | RHSA-2009:0010 |
| RHEL 4 | squirrelmail | 1.4.8-5.el4_7.2 | RHSA-2009:0010 |
| RHEL 3 | squirrelmail | 1.4.8-8.el3 | RHSA-2009:0010 |
Advisories 1
- RHSA-2009:0010 Red Hat Security Advisory: squirrelmail security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- http://www.nabble.com/ANNOUNCE:-SquirrelMail-1.4.16-Released-td19711998.html
- 33937 third-party-advisory
- http://int21.de/cve/CVE-2008-3663-squirrelmail.html
- 31321 vdb-entry
- http://support.apple.com/kb/HT3438
- 4304 third-party-advisory
- APPLE-SA-2009-02-12 vendor-advisory
- 20080922 Squirrelmail: Session hijacking vulnerability, CVE-2008-3663 mailing-list
- squirrelmail-cookie-session-hijacking(45700) vdb-entry
- SUSE-SR:2009:004 vendor-advisory
- SUSE-SR:2008:028 vendor-advisory
- oval:org.mitre.oval:def:10548 vdb-entry signature