FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-3585

This CVE name corresponds to:

Entered	Topic
2009-12-09	rt -- Session fixation vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-3585 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-3585
Phase	Assigned(20091007)

Description

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.

References

Source	Reference
MLIST	[rt-announce] 20091130 SECURITY - RT 3.6.10 Released
MLIST	[rt-announce] 20091130 SECURITY - Session Fixation Vulnerability in RT 3.0.0-3.8.5
CONFIRM	http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch
CONFIRM	http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch
CONFIRM	http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch
CONFIRM	http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch
CONFIRM	http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch
CONFIRM	http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch
CONFIRM	http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html
FEDORA	FEDORA-2009-12783
FEDORA	FEDORA-2009-12817
FEDORA	FEDORA-2009-12827
BID	37162
SECUNIA	37546
SECUNIA	37728
XF	rt-unspecified-session-hijacking(54472)