FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mantis -- session hijacking vulnerability

Affected packages
mantis < 1.1.3

Details

VuXML ID 00d6040a-b8e0-11dd-a578-0030843d3802
Discovery 2008-10-14
Entry 2008-11-22

The mantis Team reports:

When configuring a web application to use only ssl (e. g. by forwarding all http-requests to https), a user would expect that sniffing and hijacking the session is impossible. Though, for this to be secure, one needs to set the session cookie to have the secure flag. Else the cookie will be transferred through http if the victim's browser does a single http-request on the same domain.

References

CVE Name CVE-2008-3102
URL http://enablesecurity.com/2008/08/11/surf-jack-https-will-not-save-you/
URL http://int21.de/cve/CVE-2008-3102-mantis.html
URL http://www.mantisbt.org/bugs/view.php?id=9524
URL http://www.mantisbt.org/bugs/view.php?id=9533