full-disclosure - Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <7E06D045-D317-4305-9B60-55170806D47C@gmail.com>
Date: Tue, 25 Oct 2011 19:50:31 -0400
From: William Reyor <opticfiber@...il.com>
To: Darren McDonald <darren@...donald.net>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	information security <informationhacker08@...il.com>
Subject: Re: Microsoft Outlook Web Access Session
	sidejacking/Session Replay Vulnerability

That's my point, if a connection can only be established via SSL how can some one sidejack without either degrading the connection, or having physical access to the machine.

In all modern instances I've seen owa deployed, it requires SSL out of the box.

On Oct 25, 2011, at 7:45 PM, Darren McDonald <darren@...donald.net> wrote:

> On 26 October 2011 00:30, William Reyor <opticfiber@...il.com> wrote:
>> How would a remote attacker be able to read my systems memory?
>> 
> 
> ... how would someone gain access to your session token?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/