Full Disclosure mailing list archives
Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability
From: information security <informationhacker08 () gmail com>
Date: Thu, 27 Oct 2011 17:57:34 +0530
so this is will be considered as vulnerability or not ? because Successful exploits may allow attackers to hijack web sessions or bypass authentication through a replay attack and gain access to a victim's email account. Asheesh On Wed, Oct 26, 2011 at 5:55 AM, Darren McDonald <athena () dmcdonald net>wrote:
I think you'll find that it was my point as well :) Sidejacking isnt a vulnerability. It's the end result after an actual vulnerability has been exploited. I.e. crappy session management, not setting the secure flag, poor use of HTTPS, SSLv2/cipher reuse+weak ciphers+crap browser, or whatever moronic thing the developer did to allow the session token to go over the network in the clear in the first place. Apparently sarcasm is a lost art form. Renski
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability information security (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability William Reyor (Oct 25)
- Message not available
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability William Reyor (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)
- Message not available
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability William Reyor (Oct 26)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability information security (Oct 27)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability William Reyor (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)
- Re: Microsoft Outlook Web Access Session sidejacking/Session Replay Vulnerability Darren McDonald (Oct 25)