Re: CVE request: novnc: session hijack through insecurely set session token cookies

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> noVNC prior to this patch:
> https://github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd
> allows an attacker to steal insecurely set session token cookies,
> hijacking active or inactive VNC sessions.
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1193451

> Adds support for secure attribute on token cookie

> This patch adds support for the secure attribute on token
> cookies (sent by nova-novncproxy). If the https is used
> to transfer the cookie, the secure attribute is set thus
> restricting server requestes to secure conections only.
> This should prevent man-in-the-middle attacks.

Use CVE-2013-7436. The "If the https is used to transfer the cookie"
text in the commit seems somewhat confusing. As far as we can tell,
the new code does not mean that the server looks for cookie
transmission over https and then decides to use the secure attribute.
Instead, the new code seems to have the "normal" behavior in which the
server sets the secure attribute upon any use of an https session by
the client.

In other words, there isn't an incomplete fix in which the first
cookie transmission over https lacks the secure attribute.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJVAfXlAAoJEKllVAevmvmspnYH/j1lH1Nm/160CaQWIPg3jWi0
I2pBb6ITCQ53UNLnXOAHWjPbDBNtjJbznVzU9wXH3x+B1Ty3RSBrnQ8UdKXJQ908
224P3JYl+BfRrNQh2p4Ds600THZijh5KC6ojk293Y5nN1Z3s6d4FvZVTosaRd+nf
auK+aOzik32xo8gSRo296ktz0tEa7mdMx7484Zau6jubYhzBKq9mNTz96Fx9nNz0
GX2m/7zId/PvoMSfH96QbhXOePPU4PJJIH58KXUQeWqCQM3rRuMsXNoIfg9eRsLW
ki/dPQZidUWwYlSy0OwqFAUUfjX0gnGOSSdxGXUSuUXBQDKamvsLL09Xz+EoeGo=
=rp9s
-----END PGP SIGNATURE-----