Bug 269922

Summary:	<=net-misc/ajaxterm-0.10 DoS, Session hijacking (CVE-2009-1629)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	maintainer-needed, treecleaner
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~3 [noglsa]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-05-15 09:15:52 UTC

CVE-2009-1629 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1629):
  ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with
  predictable random numbers based on certain JavaScript functions,
  which makes it easier for remote attackers to (1) hijack a session or
  (2) cause a denial of service (session ID exhaustion) via a
  brute-force attack.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2009-05-18 15:30:30 UTC

There is a mitigation patch to increase session id space here:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528938

Comment 2 Pacho Ramos gentoo-dev

2012-02-27 19:49:55 UTC

Time to treeclean this?

Comment 3 Pacho Ramos gentoo-dev

2012-04-06 19:31:51 UTC

dropped

Comment 4 Alex Legler (RETIRED) archtester

2012-04-07 10:44:06 UTC

as usual: don't close security bugs, please.

Closing as FIXED with noglsa.