May 01, 2009

Cenzic Detects a Session Hijacking Vulnerability in the IBM WebSphere Application

The IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability is now detectable in the Cenzic Web Server SmartAttack

As of May 1, 2009, Cenzic can now detect the IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability (BugtraqID 34501). An attacker can exploit this issue to gain access to an authenticated session with the privileges of the hijacked user.

This week’s product update also includes an enhancement to our Acquire Session ID SmartAttack (version 1.2.4.). This SmartAttack now has a more synchronized code, extended support for indentifying custom name session tokens, and minor bug fixes. It’s also expected to work more accurately with other session SmartAttacks (CSRF, Clickjacking) to help them identify custom name tokens.

Background on Cenzic’s SmartAttacks
Every week, Cenzic’s suite of products is updated with the latest vulnerabilities (custom, commercial, and open-source) to better detect "holes" in Web applications. These Web application vulnerabilities include (but not limited to) cross site scripting, buffer overflow, path or directory traversal, SQL injection, HTTP response splitting, and other workflow types.

by
Erin Swanson
Eswanson@cenzic.com


	IBM WebSphere Application Server Forced Logout Session Hijacking Vulnerability
	Learn more about this vulnerability on Security Focus
	http://www.securityfocus.com/bid/34501/

Topic Tags: cenzic, IBM, session hijacking

by Erin Swanson

↑top

link to this

Post a Comment

Title:

Summary:

Comment:

Links:

Your info:

Name:		Required; will be displayed with comment.
E-mail:		Required (in case we need to contact you); will NOT be displayed with comment.
Web:		Optional; will use to hyperlink your name in the comment.
Twitter:		Optional; allows visitors to follow you on Twitter.
Save this in my browser

Verification:

Type the characters you see in the picture above.

Letters are case sensitive.

Notice: Your thoughtful opinions are valued and encouraged, but all comments are moderated so there will be a delay between the time you post your comment and when it appears in this site. Please don't be offended if your comment is edited for clarity or to avoid questionable matters. Offensive or off-topic comments will be deleted.