From: Secunia Security Advisories (sec-advsecunia.com)
Date: Fri Jul 15 2005 - 04:35:44 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?

Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Macromedia JRun Authentication Token Security Issue

SECUNIA ADVISORY ID:
SA16081

VERIFY ADVISORY:
http://secunia.com/advisories/16081/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
From remote

SOFTWARE:
Macromedia Jrun 4.x
http://secunia.com/product/863/
Macromedia ColdFusion MX 7
http://secunia.com/product/4984/
Macromedia ColdFusion MX 6.x
http://secunia.com/product/864/

DESCRIPTION:
A security issue has been reported in JRun, which can result in
malicious users gaining access to another user's session.

The problem is caused due to a race condition where JRun in certain
situations during heavy load may generate the same authentication
token for two different sessions. This may allow a malicious
authenticated user to access another user's session.

The security issue affects the following versions:
* ColdFusion MX 7.0 Enterprise Multi-Server Edition
* ColdFusion MX 6.1 Enterprise with JRun
* JRun 4.0

SOLUTION:
Apply patch:
http://download.macromedia.com/pub/security/mpsb05-05.zip

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Greg Ball, University of Virginia.

ORIGINAL ADVISORY:
Macromedia:
http://www.macromedia.com/devnet/security/security_zone/mpsb05-05.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]