CVE-2008-0128 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2008-0128
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2008-0128

Description: The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/39804 SUSE http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html SAID Secunia Advisory: SA28552 Secunia Advisory: SA29242 Secunia Advisory: SA31493 Secunia Advisory: SA28549 REDHAT http://rhn.redhat.com/errata/RHSA-2008-0630.html http://www.redhat.com/support/errata/RHSA-2008-0261.html DEBIAN http://www.debian.org/security/2008/dsa-1468 CONFIRM http://security-tracker.debian.net/tracker/CVE-2008-0128 http://issues.apache.org/bugzilla/show_bug.cgi?id=41217 BID 27365

Return to the previous page.