Tiny Java Web Server / Bugs / #8 Security issue in session id generation mechanism

#8 Security issue in session id generation mechanism

Milestone: v1.0_(example)

Status: accepted

Owner: Д Рогаткин

Labels: Security issue (1) Session Hijacking (1)

Priority: 9

Updated: 2014-05-21

Created: 2014-05-19

Creator: Anonymous

Private: No

Hi Dmitriy! Hi all!

I inspected code of TJWS and found security vulnerability in session id generation mechanism that lead to session hijacking attack. I sent all details to jAddressBook@gmail.com email as specified on http://tjws.sourceforge.net/ website.

Let me know if you have questions.

Discussion

Д Рогаткин - 2014-05-21

Build 106 made it less predictable

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

Д Рогаткин - 2014-05-21

status: open --> accepted
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
- Anonymous
  
  Add attachments
  Cancel
  You seem to have CSS turned off. Please don't fill out this field.
  
  You seem to have CSS turned off. Please don't fill out this field.

Anonymous

Security issue in session id generation mechanism

Group

Searches

Help

#8 Security issue in session id generation mechanism

Discussion