269922 – <=net-misc/ajaxterm-0.10 DoS, Session hijacking (CVE-2009-1629)

Bug 269922 - <=net-misc/ajaxterm-0.10 DoS, Session hijacking (CVE-2009-1629)

Summary: <=net-misc/ajaxterm-0.10 DoS, Session hijacking (CVE-2009-1629)

Status:	RESOLVED FIXED

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	High trivial (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	~3 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2009-05-15 09:15 UTC by Alex Legler (RETIRED)
Modified:	2012-04-07 10:44 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Alex Legler (RETIRED) archtester

2009-05-15 09:15:52 UTC

CVE-2009-1629 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1629):
  ajaxterm.js in AjaxTerm 0.10 and earlier generates session IDs with
  predictable random numbers based on certain JavaScript functions,
  which makes it easier for remote attackers to (1) hijack a session or
  (2) cause a denial of service (session ID exhaustion) via a
  brute-force attack.

Comment 1 Robert Buchholz (RETIRED) gentoo-dev

2009-05-18 15:30:30 UTC

There is a mitigation patch to increase session id space here:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528938

Comment 2 Pacho Ramos gentoo-dev

2012-02-27 19:49:55 UTC

Time to treeclean this?

Comment 3 Pacho Ramos gentoo-dev

2012-04-06 19:31:51 UTC

dropped

Comment 4 Alex Legler (RETIRED) archtester

2012-04-07 10:44:06 UTC

as usual: don't close security bugs, please.

Closing as FIXED with noglsa.