PT-2009-1025 · Ajaxterm · Ajaxterm

Michael Greb · Published 2009-05-14 · Updated 2018-10-10 · CVE-2009-1629

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AjaxTerm versions 0.10 and earlier

Description The issue allows remote attackers to hijack a session or cause a denial of service due to session ID exhaustion via a brute-force attack. This is because session IDs are generated with predictable random numbers based on certain JavaScript functions.

Recommendations For AjaxTerm versions 0.10 and earlier, consider updating to a version that generates session IDs with truly random numbers to prevent session hijacking and denial of service attacks. As a temporary workaround, consider implementing additional session validation mechanisms to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2015-03048

CVE-2009-1629

DSA-1994-1

Affected Products

Ajaxterm

References · 12

• 🔥 http://ocert.org/advisories/ocert-2009-004.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2009/05/11/1 · Exploit
• https://osv.dev/vulnerability/CVE-2009-1629 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052655.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1629 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1629 · Security Note
• https://bdu.fstec.ru/vul/2015-03048 · Security Note
• http://securityfocus.com/bid/34903 · Note
• http://debian.org/security/dsa-1994 · Note
• http://secunia.com/advisories/42784 · Note
• http://securityfocus.com/archive/1/503421/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50464 · Note