full-disclosure - Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADz_VDFFcRUf7SnFOHTpri6XcSQBB=0=TcC4QnAQn0kfU7AZPg@mail.gmail.com>
Date: Tue, 25 Oct 2011 21:47:05 +0100
From: Darren McDonald <athena@...donald.net>
To: information security <informationhacker08@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Microsoft Outlook Web Access Session
 sidejacking/Session Replay Vulnerability

On 25 October 2011 19:26, information security
<informationhacker08@...il.com> wrote:
>
> #Product  Outlook Web Access 8.2.254.0
>
>
> #Vulnerability
> SideJacking is the process of sniffing web cookies, then replaying them to
> clone another user's web session. Using a cloned web session, the jacker can
> exploit the victim's previously-established site access
>

Wait, your saying if someone gets the session token, they get access
to the session! Oh my god, why didnt I see it before? We're so
screwed, almost every web application I've ever used, written, or
tested is vulnerable to this issue. Quick, close down the internet
before it's too late!

Renski

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/