IBM WebSphere Application Server Predictable Session ID Vulnerability
BID:3349
Info
IBM WebSphere Application Server Predictable Session ID Vulnerability
| Bugtraq ID: | 3349 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 19 2001 12:00AM |
| Updated: | Sep 19 2001 12:00AM |
| Credit: | This vulnerability was submitted to BugTraq on September 19th, 2001 by Mark Heuse <[email protected]>. |
| Vulnerable: |
IBM WebSphere Commerce Suite Service Provider 3.2 IBM WebSphere Commerce Suite Service Provider 3.1.2 IBM WebSphere Application Server Advanced Edition 3.0 .2.1 IBM Websphere Application Server 3.5.3 IBM Websphere Application Server 3.5.2 IBM Websphere Application Server 3.5.1 IBM Websphere Application Server 3.0 .2.4 IBM Websphere Application Server 3.0 .2.3 IBM Websphere Application Server 3.0 .2.2 |
| Not Vulnerable: |
IBM WebSphere Application Server Enterprise Edition 4.0 |
Discussion
IBM WebSphere Application Server Predictable Session ID Vulnerability
IBM WebSphere Application Server uses predictable sequence numbers for session IDs when issuing cookies to users. Specifically, most of the session ID is static and the characters which are variable are not entirely random. This is further compounded by the fact that the session ID is composed of alphanumeric(A-Z, 0-9) characters, so WebSphere cycles through a limited range of possibilities. Consequently, the sequence number may be easily anticipated.
If this issue is successfully exploited then it is possible for an attacker to obtain the cookie-based authentication credentials for other users, allowing unauthorized access to the vulnerable application.
NOTE: This issue was resolved in IBM WebSphere Application Server 4.0(and later) and any information about patching these versions should be disregarded.
IBM WebSphere Application Server uses predictable sequence numbers for session IDs when issuing cookies to users. Specifically, most of the session ID is static and the characters which are variable are not entirely random. This is further compounded by the fact that the session ID is composed of alphanumeric(A-Z, 0-9) characters, so WebSphere cycles through a limited range of possibilities. Consequently, the sequence number may be easily anticipated.
If this issue is successfully exploited then it is possible for an attacker to obtain the cookie-based authentication credentials for other users, allowing unauthorized access to the vulnerable application.
NOTE: This issue was resolved in IBM WebSphere Application Server 4.0(and later) and any information about patching these versions should be disregarded.
Exploit / POC
IBM WebSphere Application Server Predictable Session ID Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
IBM WebSphere Application Server Predictable Session ID Vulnerability
Solution:
This issue was resolved in IBM WebSphere Application Server 4.0(and later) and any information about patching these versions should be disregarded.
The vendor has released a patch which addresses this issue.
IBM Websphere Application Server 3.0 .2.2
IBM Websphere Application Server 3.0 .2.3
IBM WebSphere Application Server Advanced Edition 3.0 .2.1
IBM Websphere Application Server 3.0 .2.4
IBM Websphere Application Server 3.5.1
IBM Websphere Application Server 3.5.2
IBM Websphere Application Server 3.5.3
Solution:
This issue was resolved in IBM WebSphere Application Server 4.0(and later) and any information about patching these versions should be disregarded.
The vendor has released a patch which addresses this issue.
IBM Websphere Application Server 3.0 .2.2
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM Websphere Application Server 3.0 .2.3
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM WebSphere Application Server Advanced Edition 3.0 .2.1
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM Websphere Application Server 3.0 .2.4
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM Websphere Application Server 3.5.1
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM Websphere Application Server 3.5.2
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
IBM Websphere Application Server 3.5.3
-
IBM E-fix PQ47663V302
http://www-4.ibm.com/software/webservers/appserv/efix_new.html
References
IBM WebSphere Application Server Predictable Session ID Vulnerability
References:
References: