PT-2009-2191 · Apache+1 · Apache Tomcat+1

Published 2009-04-14 · Updated 2009-04-29 · CVE-2008-6722

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Novell Access Manager version 3 SP4

Description: The issue is related to the improper expiration of X.509 certificate sessions, allowing physically proximate attackers to obtain a logged-in session. This occurs when a victim's web-browser process continues to send the original and valid SSL sessionID. The problem is also related to the inability of Apache Tomcat to clear entries from its SSL cache.

Recommendations: For Novell Access Manager version 3 SP4, consider restricting access to the SSL cache to minimize the risk of exploitation. As a temporary workaround, restrict the use of X.509 certificate sessions until a proper fix is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-6722

Affected Products

Apache Tomcat

Novell Access Manager

References · 6

• http://vupen.com/english/advisories/2008/3012 · Vendor Advisory
• http://secunia.com/advisories/32554 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6722 · Security Note
• http://novell.com/support/viewContent.do?externalId=7001788 · Note
• http://securityfocus.com/bid/32121 · Note
• http://osvdb.org/49737 · Note