JVN#18700809
Cybozu Garoon session fixation vulnerability
Overview
Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability.
Products Affected
- Cybozu Garoon version 2.0.0 - 2.1.3
Description
Cybozu Garoon, a groupware from Cybozu, contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into Cybozu Garoon using a session ID provided by the attacker.
Impact
A remote attacker impersonating a logged in user may execute arbitrary code with the privilege of the user. As a result, disclosure or alteration of information may occur.
Solution
Update the Software
Apply the latest update provided by the vendor.
References
JPCERT/CC Addendum
The vendor has published information on this problem on April 14 2008.Vulnerability Analysis by JPCERT/CC
Analyzed on 2008.06.27
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | Routed - can be attacked over the Internet using packets |
|
| Authentication | None - anonymous or no authentication (IP addresses do not count) |
|
| User Interaction Required | Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file |
|
| Exploit Complexity | Low - little to no expertise and/or luck required to exploit (cross-site scripting) |
|
Credit
Yoshihiro Ishikawa of LAC (Little eArth Corporation) reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE |
CVE-2008-6569 |
| JVN iPedia |
JVNDB-2008-000034 |