oss-security - Re: A note on cookie based sessions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201310040812.r948Cp7b001306@linus.mitre.org>
Date: Fri, 4 Oct 2013 04:12:51 -0400 (EDT)
From: cve-assign@...re.org
To: fw@...eb.enyo.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: A note on cookie based sessions

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>What about applications built on top of those stacks which do not
>document this?  Would they receive a CVE?

Referring to

  http://openwall.com/lists/oss-security/2013/09/04/13

CVEs can be obtained by the upstream vendor of an application
framework with this behavior, and CVEs can be obtained by the upstream
vendor of an individual application with this behavior.

http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/
says "Rails will issue a new, empty-ish cookie to the user's browser
in order to overwrite the one granted when the user originally
authenticated, and instruct the Web browser to use this newest one
from this point forth. This relies on good browser behavior."

This approach addresses one important threat model: an unattended
workstation that had been using a normal web browser, successfully
completed this type of logout, and left that normal web browser
running. (The attacker had wanted to make a quick unauthorized use of
a web application by typing/clicking something at that specific
workstation, within that specific browser session.) From our
perspective, each upstream vendor may decide among options such as:

  - announce that there was a software mistake because they were
    actually intending to address other threat models

  - announce that they hadn't intended to address other threat models,
    but now wish to make a security enhancement

  - do nothing

The first option gets the CVE.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSTngVAAoJEKllVAevmvms3XYH/RKJcf8dqAUZBps+bhDqa9mG
PSjyYXukM6LYoyYJcfzzkZgtTSxNvXMfcYOPF8P/LU6U0RcnRl+EMqj1uquuAExo
wx+uoDHZJg+NU0WsAmJxzeu3jCK8KcUB1NyDOaH50ThRcMpmFo+xiyaXYLb7TZDH
pp/7CEJBRKib28FhvwJZ3nvYNBPG1veTvmzJ6b4FC3eHHbOKkjwWjuST5CjeshH3
+rucE01s5FQP+qxbUH33aIMkb6xp2AyuCwlJrpI/WMiW6198GCLbmWGN5VIqnHxw
p+AVgrh1G6GsdUu+iZejgK7ymrYJQZHEdxIg08H8U2XkZTz6d0AXaih63dJ0lvk=
=FKMa
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.