Date: Thu, 12 Mar 2015 16:29:11 -0400 (EDT) From: cve-assign@...re.org To: vkaigoro@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: novnc: session hijack through insecurely set session token cookies -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > noVNC prior to this patch: > https://github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd > allows an attacker to steal insecurely set session token cookies, > hijacking active or inactive VNC sessions. > > https://bugzilla.redhat.com/show_bug.cgi?id=1193451 > Adds support for secure attribute on token cookie > This patch adds support for the secure attribute on token > cookies (sent by nova-novncproxy). If the https is used > to transfer the cookie, the secure attribute is set thus > restricting server requestes to secure conections only. > This should prevent man-in-the-middle attacks. Use CVE-2013-7436. The "If the https is used to transfer the cookie" text in the commit seems somewhat confusing. As far as we can tell, the new code does not mean that the server looks for cookie transmission over https and then decides to use the secure attribute. Instead, the new code seems to have the "normal" behavior in which the server sets the secure attribute upon any use of an https session by the client. In other words, there isn't an incomplete fix in which the first cookie transmission over https lacks the secure attribute. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVAfXlAAoJEKllVAevmvmspnYH/j1lH1Nm/160CaQWIPg3jWi0 I2pBb6ITCQ53UNLnXOAHWjPbDBNtjJbznVzU9wXH3x+B1Ty3RSBrnQ8UdKXJQ908 224P3JYl+BfRrNQh2p4Ds600THZijh5KC6ojk293Y5nN1Z3s6d4FvZVTosaRd+nf auK+aOzik32xo8gSRo296ktz0tEa7mdMx7484Zau6jubYhzBKq9mNTz96Fx9nNz0 GX2m/7zId/PvoMSfH96QbhXOePPU4PJJIH58KXUQeWqCQM3rRuMsXNoIfg9eRsLW ki/dPQZidUWwYlSy0OwqFAUUfjX0gnGOSSdxGXUSuUXBQDKamvsLL09Xz+EoeGo= =rp9s -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ