SecurityReason.com - Our Reason is

Security

Register | Forget Password | Login
SecurityReason
WLB
Services
RSS
Corporate
Note

If you have found a vulnerability, please send to our SecurityAlert Database :
secalert()securityreason()com

Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com

Home arrow SecurityAlert Database

Arrow  Topic :

onelook onebyone CMS - Session fixation Issue


Arrow  SecurityAlert : 2546
Arrow  CVE : CVE-2007-1952
Arrow  SecurityRisk : Medium  Security Risk Medium  (About)
Arrow  Remote Exploit : Yes
Arrow  Local Exploit : No
Arrow  Exploit Available : No
Arrow  Credit : David Vieira-Kurz
Arrow  Published : 13.04.2007

Arrow  Affected Software : onebyone CMS



Arrow  Advisory Content :  

[MajorSecurity Advisory #39]onelook onebyone CMS - Session fixation Issue

Details
=======
Product: onebyone CMS
Remote-Exploit: yes
Vendor-URL: http://www.onebyone.ch/
Vendor-Status: informed
Advisory-Status: published

Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de

Original Advisory:
============
http://www.majorsecurity.de/index_2.php?major_rls=major_rls39

Introduction
============
onebyone CMS is a Content Management System.

More Details
============
1. Session fixation:
The Cookie variable "PHPSESSID" can be set to a malicious and arbitrary
value.

1.1 Classification:
Session Fixation is an attack technique that forces a user's session ID to
an explicit value.
Depending on the functionality of the target web site, a number of
techniques can be utilized to "fix" the session ID value.
These techniques range from Cross-site Scripting exploits to peppering the
web site with previously made HTTP requests.
After a user's session ID has been fixed, the attacker will wait for them
to login.
Once the user does so, the attacker uses the predefined session ID value to
assume their online identity.

Workaround:
============
1. Do not accept session identifiers from GET / POST variables:
Session identifiers in URL (query string, GET variables) or POST variables
are not recommended as it simplifies this attack - it is easy to make links
or forms which sets GET / POST variables.

2.Regenerate SID on each request:
A powerful countermeassure against session fixation is to "regenerate"
session identifier (SID) on each request.
This means that although attacker may trick a user into accepting a known
SID, the SID will be invalid when attacker attempts to re-use the SID.

3. Accept only server generated SID:
One way to improve security is to not accept session identifiers not
generated by server.

if ( ! isset( $_SESSION['SERVER_GENERATED_SID'] ) ) {
session_destroy(); // destroy all data in session
}
session_regenerate_id(); // generate a new session identifier
$_SESSION['SERVER_GENERATED_SID'] = true;

References:
-------------------------------------------------
http://www.acrossecurity.com/papers/session_fixation.pdf
http://www.webappsec.org/projects/threat/classes/session_fixation.shtml

History/Timeline
================
29.03.2007 discovery of the vulnerability
30.03.2007 additional tests with other versions
02.04.2007 contacted the vendor
05.04.2007 advisory is written
06.04.2007 advisory released

MajorSecurity
=======
MajorSecurity is a German penetration testing and security research
project
which consists of only one person at the present time.
Currently looking for a site sponsor.
http://www.majorsecurity.de/





Arrow  Feedback :

If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
Alert

libc:fts_*() Multiple Denial of Service

Security Risk Medium- 2009-10-02

The fts functions are provided for traversing UNIX file hierarchies...

Apache RSS Apache Alert

» Apache 1.3.41 mod_proxy
   Integer overflow (code
   execution)

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion in work
   directory

» Apache Tomcat 6.0.20 and
   5.5.28 insecure partial
   deploy after failed
   undeploy

» Apache Tomcat 6.0.20 and
   5.5.28 unexpected file
   deletion and/or
   alteration

PHP RSS PHP Alert

» PHP 5.2.12/5.3.1
   session.save_path
   safe_mode and
   open_basedir bypass

» PHP 5.2.12/5.3.1 Multiple
   Vulnerabilities

» PHP 5.2.11 libgd multiple
   vulnerabilities

» PHP 5.2.11 tempnam()
   safe_mode bypass

Copyright © SecurityReason.com. All Rights Reserved.