full-disclosure - IBM Potential Credential Impersonation Attack paper?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87zn7iugcl.fsf@deneb.enyo.de>
From: fw at deneb.enyo.de (Florian Weimer)
Subject: IBM Potential Credential Impersonation Attack
 paper?

> I found the following IBM advisory via their outside advisory service:
> http://www-1.ibm.com/support/docview.wss?uid=swg21168762
>
> They refer to an externally available paper that identifies a form of
> credential impersonation exploit that can affect multiple IBM
> products. Does anybody know which paper IBM is refering to? I tried
> google, but I couldn' t find anything.

It looks like a session fixation vulnerability (if this is the right
terminology):

| Internal Defect: 45186
| 
| Symptom: When a user logs in using forms authentication, they receive
| a cookie and a login page. The user logs in and obtains a
| credential. A security vulnerability exists where an attacker could
| send his unauthenticated cookie to person X. If person X logged in
| using this cookie, the attacker could hijack the seesion of person X

<http://www-1.ibm.com/support/docview.wss?uid=swg24006533>

-- 
Current mail filters: many dial-up/DSL/cable modem hosts, and the
following domains: bigpond.com, di-ve.com, fuorissimo.com, hotmail.com,
jumpy.it, libero.it, netscape.net, postino.it, simplesnet.pt, spymac.com,
tiscali.co.uk, tiscali.cz, tiscali.it, voila.fr, yahoo.com.