Re: [Full-Disclosure] IBM Potential Credential Impersonation Attack paper?

[Florian Weimer <fw@xxxxxxxxxxxxx>]

> I found the following IBM advisory via their outside advisory service:
> http://www-1.ibm.com/support/docview.wss?uid=swg21168762
>
> They refer to an externally available paper that identifies a form of
> credential impersonation exploit that can affect multiple IBM
> products. Does anybody know which paper IBM is refering to? I tried
> google, but I couldn' t find anything.


It looks like a session fixation vulnerability (if this is the right
terminology):

| Internal Defect: 45186
| 
| Symptom: When a user logs in using forms authentication, they receive
| a cookie and a login page. The user logs in and obtains a
| credential. A security vulnerability exists where an attacker could
| send his unauthenticated cookie to person X. If person X logged in
| using this cookie, the attacker could hijack the seesion of person X

<http://www-1.ibm.com/support/docview.wss?uid=swg24006533>

-- 
Current mail filters: many dial-up/DSL/cable modem hosts, and the
following domains: bigpond.com, di-ve.com, fuorissimo.com, hotmail.com,
jumpy.it, libero.it, netscape.net, postino.it, simplesnet.pt, spymac.com,
tiscali.co.uk, tiscali.cz, tiscali.it, voila.fr, yahoo.com.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html