Date: Fri, 4 Oct 2013 04:12:51 -0400 (EDT) From: cve-assign@...re.org To: fw@...eb.enyo.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: A note on cookie based sessions -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >What about applications built on top of those stacks which do not >document this? Would they receive a CVE? Referring to http://openwall.com/lists/oss-security/2013/09/04/13 CVEs can be obtained by the upstream vendor of an application framework with this behavior, and CVEs can be obtained by the upstream vendor of an individual application with this behavior. http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/ says "Rails will issue a new, empty-ish cookie to the user's browser in order to overwrite the one granted when the user originally authenticated, and instruct the Web browser to use this newest one from this point forth. This relies on good browser behavior." This approach addresses one important threat model: an unattended workstation that had been using a normal web browser, successfully completed this type of logout, and left that normal web browser running. (The attacker had wanted to make a quick unauthorized use of a web application by typing/clicking something at that specific workstation, within that specific browser session.) From our perspective, each upstream vendor may decide among options such as: - announce that there was a software mistake because they were actually intending to address other threat models - announce that they hadn't intended to address other threat models, but now wish to make a security enhancement - do nothing The first option gets the CVE. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJSTngVAAoJEKllVAevmvms3XYH/RKJcf8dqAUZBps+bhDqa9mG PSjyYXukM6LYoyYJcfzzkZgtTSxNvXMfcYOPF8P/LU6U0RcnRl+EMqj1uquuAExo wx+uoDHZJg+NU0WsAmJxzeu3jCK8KcUB1NyDOaH50ThRcMpmFo+xiyaXYLb7TZDH pp/7CEJBRKib28FhvwJZ3nvYNBPG1veTvmzJ6b4FC3eHHbOKkjwWjuST5CjeshH3 +rucE01s5FQP+qxbUH33aIMkb6xp2AyuCwlJrpI/WMiW6198GCLbmWGN5VIqnHxw p+AVgrh1G6GsdUu+iZejgK7ymrYJQZHEdxIg08H8U2XkZTz6d0AXaih63dJ0lvk= =FKMa -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.