IBM OmniFind Session-Fixation Vulnerability
BID:44943
Info
IBM OmniFind Session-Fixation Vulnerability
| Bugtraq ID: | 44943 |
| Class: | Unknown |
| CVE: |
CVE-2010-3892 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2010 12:00AM |
| Updated: | Nov 09 2010 12:00AM |
| Credit: | Fatih Kilic |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
IBM OmniFind Session-Fixation Vulnerability
IBM OmniFind is prone to a session-fixation vulnerability.
Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.
IBM OmniFind versions 8.5 and 9.0 are affected; other versions may also be vulnerable.
NOTE: This issue was previously covered in BID 44740 (IBM OmniFind Multiple Vulnerabilities) but has been given its own record to better document it.
IBM OmniFind is prone to a session-fixation vulnerability.
Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.
IBM OmniFind versions 8.5 and 9.0 are affected; other versions may also be vulnerable.
NOTE: This issue was previously covered in BID 44740 (IBM OmniFind Multiple Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
IBM OmniFind Session-Fixation Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user into following a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting user into following a malicious URI.
Solution / Fix
IBM OmniFind Session-Fixation Vulnerability
Solution:
Reportedly the vendor has fixed the issue, however, Symantec has not confirmed it. Please contact the vendor for more information.
Solution:
Reportedly the vendor has fixed the issue, however, Symantec has not confirmed it. Please contact the vendor for more information.
References
IBM OmniFind Session-Fixation Vulnerability
References:
References:
- IBM OmniFind Homepage (IBM)
- IBM OmniFind several issues (Fatih Kilic)
- IBM OmniFind - several vulnerabilities (Fatih Kilic