Bug #19831
Session fixation vulnerability in user authentication
| Status: | Resolved | Start date: | 2009-01-15 | |
|---|---|---|---|---|
| Priority: | Must have | Due date: | ||
| Assigned To: | Marcus Krause | % Done: | 0% |
|
| Category: | - | Spent time: | - | |
| Target version: | - | |||
| TYPO3 Version: | 4.0 | Is Regression: | ||
| PHP Version: | 5.2 | Sprint Focus: | ||
| Complexity: |
Description
references TYPO3 Security Team OTRS issue #2008102610000015
Versions:
4.0 up to trunk (4.0, 4.1, 4.2, trunk)
Problem:
Session IDs are reused by TYPO3 even when they not yet exist in the db but are submitted by a client.
Solution:
Check if there's a session record in the database before using submitted session ids.
Provided by TYPO3 Security Team
(issue imported from #M10146)
10146.diff
(1.4 kB)
10146_trunk_v1.diff
(1.2 kB)
Related issues
History
#1 Updated by Marcus Krause over 6 years ago
The first patch is for trunk only as it makes use of newly added function exec_SELECTcountRows(), the other one is for 4-0 up to 4-2 where the row counting is down the old way.
ready to be committed
#2 Updated by Marcus Krause over 6 years ago
adding new patch 10146_trunk_v1.diff which replaces variablename $dbres by $count as requested by Francois
#3 Updated by Ingmar Schlecht over 6 years ago
Committed to 4.0, 4.1, 4.2 and trunk.