IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability

Bugtraq ID:	34501
Class:	Design Error
CVE:	CVE-2009-0892
Remote:	Yes
Local:	No
Published:	Mar 30 2009 12:00AM
Updated:	Apr 13 2009 10:26PM
Credit:	The vendor
Vulnerable:	IBM Websphere Application Server 6.1.2 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .9 IBM Websphere Application Server 6.1 .8 IBM Websphere Application Server 6.1 .7 IBM Websphere Application Server 6.1 .6 IBM Websphere Application Server 6.1 .5 IBM Websphere Application Server 6.1 .4 IBM Websphere Application Server 6.1 .3 IBM Websphere Application Server 6.1 .22 IBM Websphere Application Server 6.1 .21 IBM Websphere Application Server 6.1 .20 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .2 IBM Websphere Application Server 6.1 .19 IBM Websphere Application Server 6.1 .18 IBM Websphere Application Server 6.1 .17 IBM Websphere Application Server 6.1 .15 IBM Websphere Application Server 6.1 .14 IBM Websphere Application Server 6.1 .13 IBM Websphere Application Server 6.1 .12 IBM Websphere Application Server 6.1 .11 IBM Websphere Application Server 6.1 .10 IBM Websphere Application Server 6.1 .1 IBM Websphere Application Server 6.1 IBM Websphere Application Server 6.0.2 .9 IBM Websphere Application Server 6.0.2 .7 IBM Websphere Application Server 6.0.2 .5 IBM Websphere Application Server 6.0.2 .33 IBM Websphere Application Server 6.0.2 .31 IBM Websphere Application Server 6.0.2 .3 IBM Websphere Application Server 6.0.2 .29 IBM Websphere Application Server 6.0.2 .25 IBM Websphere Application Server 6.0.2 .24 IBM Websphere Application Server 6.0.2 .23 IBM Websphere Application Server 6.0.2 .22 IBM Websphere Application Server 6.0.2 .21 IBM Websphere Application Server 6.0.2 .19 IBM Websphere Application Server 6.0.2 .17 IBM Websphere Application Server 6.0.2 .15 IBM Websphere Application Server 6.0.2 .13 IBM Websphere Application Server 6.0.2 .11 IBM Websphere Application Server 6.0.2 .1 IBM Websphere Application Server 7.0.0.1 IBM Websphere Application Server 7.0 IBM Websphere Application Server 6.0.2.19
Not Vulnerable:	IBM Websphere Application Server 7.0 3 IBM Websphere Application Server 6.1 .23

IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability

IBM WebSphere Application Server is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to gain access to an authenticated session with the privileges of the hijacked user.

Versions prior to WebSphere Application Server 6.1.0.23 and 7.0.0.3 are vulnerable.

IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability

Solution:
The vendor has released updates. Please contact the vendor for details.

IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability

References:

• Fix list for IBM WebSphere Application Server version 6.1 (IBM)
  
• Fix list for IBM WebSphere Application Server version 7.0 (IBM)
  
• IBM WebSphere Application Server administrative console forced logout session hi (IBM)
  
• IBM Websphere Homepage (IBM)