Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
BID:3665
Info
Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
| Bugtraq ID: | 3665 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2001 12:00AM |
| Updated: | Dec 06 2001 12:00AM |
| Credit: | Published in Macromedia Product Security Bulletin (MPSB01-18) on Dec 6, 2001. |
| Vulnerable: |
Macromedia JRun 3.1 Macromedia JRun 3.0 |
| Not Vulnerable: | |
Discussion
Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
Allaire JRun is a web application development suite.
When a user visits a web application based on JRun, they are given a session id. Under some circumstances this session id will be appended to the URL requested, despite already being stored in a cookie. This may potentially reveal the session id to a remote web server through a referrer tag.
Allaire JRun is a web application development suite.
When a user visits a web application based on JRun, they are given a session id. Under some circumstances this session id will be appended to the URL requested, despite already being stored in a cookie. This may potentially reveal the session id to a remote web server through a referrer tag.
Exploit / POC
Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
No exploit code is required to take advantage of this issue.
No exploit code is required to take advantage of this issue.
Solution / Fix
Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
Solution:
Macromedia has released patches which address this issue.
Macromedia JRun 3.0
Macromedia JRun 3.1
Solution:
Macromedia has released patches which address this issue.
Macromedia JRun 3.0
-
Macromedia JRun Win32 jr30sp2_25232.exe
http://download.allaire.com/publicdl/en/jrun/30/jr30sp2_25232.exe -
Macromedia JRun Unix jr30sp2u_25232.sh
http://download.allaire.com/publicdl/en/jrun/30/jr30sp2u_25232.sh
Macromedia JRun 3.1
-
Macromedia JRun Win32 jrun-31-win-upgrade-us_26414.exe
http://download.allaire.com/publicdl/en/jrun/31/jrun-31-win-upgrade-us _26414.exe -
Macromedia JRun Unix jrun-31-unix-upgrade-us_26414.sh
http://download.allaire.com/publicdl/en/jrun/31/jrun-31-unix-upgrade-u s_26414.sh
References
Allaire JRun Unnecessary JSessionID Appending In URL Vulnerability
References:
References:
- JRun Product Homepage (Allaire)
- Macromedia Product Security Bulletin (MPSB01-18) (Macromedia)