PT-2009-1296 · Futomi · Futomi Cgi Cafe Access Analyzer Cgi Standard+1

Published 2009-01-02 · Updated 2009-02-26 · CVE-2008-5809

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions futomi CGI Cafe Access Analyzer CGI Standard versions 4.0.1 and earlier futomi CGI Cafe Access Analyzer CGI Professional versions 4.11.3 and earlier

Description The issue allows remote attackers to hijack sessions and obtain sensitive information about analysis results via a modified id. This is due to the use of a predictable session id.

Recommendations For futomi CGI Cafe Access Analyzer CGI Standard versions 4.0.1 and earlier, update to a version later than 4.0.1 to resolve the issue. For futomi CGI Cafe Access Analyzer CGI Professional versions 4.11.3 and earlier, update to a version later than 4.11.3 to resolve the issue. As a temporary workaround, consider regenerating session ids to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-5809

Affected Products

Futomi Cgi Cafe Access Analyzer Cgi Professional

Futomi Cgi Cafe Access Analyzer Cgi Standard

References · 5

• http://futomi.com/library/info/2008/20081212.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5809 · Security Note
• http://securityfocus.com/bid/32794 · Note
• http://jvn.jp/en/jp/JVN07468800/index.html · Note
• http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000083.html · Note