Aipo and Aipo ASP session hijacking
| aipo-aipoasp-session-hijacking (36850) |  Medium Risk |
Description:
Aipo and Aipo ASP are vulnerable to session hijacking, caused by the improper handling of sessions. By persuading the victim to log into the application using a specially-crafted link, a remote attacker could exploit this vulnerability and hijack any known user's Web session.
Platforms Affected:
- Aimluck, Aipo 3.0.1.0
- Aimluck, Aipo ASP 3.0.1.0
Remedy:
Upgrade to the latest version of Aipo and Aipo ASP (3.2.0.1 or later), available from the Aipo Web site. See References.
Consequences:
Gain Access
References:
- Aipo Web site, Aipo3 at http://aipo.aimluck.com/download/update.html.
- JVN#70075625, Vulnerability of the session fixing in Aipo [translation from Japanese by Google] at http://jvn.jp/en/jp/JVN70075625/index.html.
- BID-25843: Aipo Session Fixation Vulnerability
- CVE-2007-5154: Session fixation vulnerability in Aipo and Aipo ASP 3.0.1.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
- SA27004: Aipo / Aipo ASP Session Fixation Vulnerability
Reported:
Sep 28, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net