oss-sec mailing list archives
Re: A note on cookie based sessions
From: cve-assign () mitre org
Date: Fri, 4 Oct 2013 04:12:51 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
What about applications built on top of those stacks which do not document this? Would they receive a CVE?
Referring to http://openwall.com/lists/oss-security/2013/09/04/13 CVEs can be obtained by the upstream vendor of an application framework with this behavior, and CVEs can be obtained by the upstream vendor of an individual application with this behavior. http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/ says "Rails will issue a new, empty-ish cookie to the user's browser in order to overwrite the one granted when the user originally authenticated, and instruct the Web browser to use this newest one from this point forth. This relies on good browser behavior." This approach addresses one important threat model: an unattended workstation that had been using a normal web browser, successfully completed this type of logout, and left that normal web browser running. (The attacker had wanted to make a quick unauthorized use of a web application by typing/clicking something at that specific workstation, within that specific browser session.) From our perspective, each upstream vendor may decide among options such as: - announce that there was a software mistake because they were actually intending to address other threat models - announce that they hadn't intended to address other threat models, but now wish to make a security enhancement - do nothing The first option gets the CVE. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSTngVAAoJEKllVAevmvms3XYH/RKJcf8dqAUZBps+bhDqa9mG PSjyYXukM6LYoyYJcfzzkZgtTSxNvXMfcYOPF8P/LU6U0RcnRl+EMqj1uquuAExo wx+uoDHZJg+NU0WsAmJxzeu3jCK8KcUB1NyDOaH50ThRcMpmFo+xiyaXYLb7TZDH pp/7CEJBRKib28FhvwJZ3nvYNBPG1veTvmzJ6b4FC3eHHbOKkjwWjuST5CjeshH3 +rucE01s5FQP+qxbUH33aIMkb6xp2AyuCwlJrpI/WMiW6198GCLbmWGN5VIqnHxw p+AVgrh1G6GsdUu+iZejgK7ymrYJQZHEdxIg08H8U2XkZTz6d0AXaih63dJ0lvk= =FKMa -----END PGP SIGNATURE-----
Current thread:
- A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Alexander E. Patrakov (Oct 03)
- Re: A note on cookie based sessions Donald Stufft (Oct 03)
- Re: A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Andri Möll (Oct 04)
- Re: A note on cookie based sessions Kurt Seifried (Oct 03)
- Re: A note on cookie based sessions Florian Weimer (Oct 03)
- Re: A note on cookie based sessions cve-assign (Oct 04)
- <Possible follow-ups>
- Re: A note on cookie based sessions Igor Sverkos (Oct 04)