JRun: The Easiness of Session Fixation

From: Christoph Schnidrig (christoph.schnidrig@csnc.ch)
Date: 02/28/03

  • Next message: KF: "Re: Mandrake 9.0 local root exploit" 
    From: "Christoph Schnidrig" <christoph.schnidrig@csnc.ch>
To: <bugtraq@securityfocus.com>
Date: Fri, 28 Feb 2003 15:35:36 +0100

    Hi all

    The the Session-ID Fixation paper available from
    http://www.acros.si/papers/session_fixation.pdf mentions that JRun
    accepts abritrary Session-ID's and create new sessions with the proposed
    Session-ID. This means that it is possible to send the following URL
    http://foo/bar?jsessionid=foo123 and the JRun server will accept and use
    the proposed Session-ID (foo123). Furthermore the server will set a
    cookie in users browser with the proposed Session-ID! Using this
    technique, it is much easier to exploit this kind of attack and to enter
    in other's web application sessions.

    Is anybody aware of a vendor patch or another workaround? Is it possible
    to enforce the server to create a new Session-ID?

    Thanks a lot

    Christoph

    Relevant Pages

    • [REVS] Hold Your Sessions: An Attack on Java Session-id Geneartion
      ... Get your security news from a reliable source. ... HTTP session-id s take an important role in almost any web site today. ... this paper has an important role in describing an attack on a ... Web server communication with clients often requires state. ...
      (Securiteam)
    • Re: session id showing on url (IE 6)
      ... > Depending on the settings in the php-ini file, php first tries to write ... > cookies blocked) it will show the session-id in the url. ... The cookies are not blocked. ... This problem seems to be client side instead of server side which I ...
      (php.general)
    • Re: session id showing on url (IE 6)
      ... > Depending on the settings in the php-ini file, php first tries to write ... > cookies blocked) it will show the session-id in the url. ... The cookies are not blocked. ... This problem seems to be client side instead of server side which I ...
      (alt.php)
    • Re: Entfernte Grafiken werden nicht angezeigt
      ... Ich haben zweimal von *meinem* Server auf den remote Server (mit den ... Und wie kommt dann Dein Browser zur Graphik? ... IP-Adresse *meines* Servers ... und zwar beim Generieren der Session-ID. ...
      (de.comp.lang.perl.misc)
    • Re: The Easiness of Session Fixation
      ... As a workaround, you can simply roll-your-own session IDs instead of using ... Subject: JRun: The Easiness of Session Fixation ... > The the Session-ID Fixation paper available from ... > http://foo/bar?jsessionid=foo123 and the JRun server will accept and use ...
      (Bugtraq)