REDHAT-BUG-607179
First published: Wed Jun 23 2010(Updated: )
It was reported that Luci's (Luci is a web based front-end component of the Conga cluster management system) user session timeout feature depended only on JavaScript script running in the user's browser. If user closed browser tab without logging out of Luci session and without closing browser, they could re-open Luci web interface and continue using the session even after the timeout period has elapsed. References: <a href="http://sourceware.org/cluster/conga/">http://sourceware.org/cluster/conga/</a> Acknowledgement: Red Hat would like to thank George Hedfors of Cybercom Sweden East AB for reporting this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Conga | ||
| Luci |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://sourceware.org/cluster/conga/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=607179#c0
- https://rhn.redhat.com/errata/RHSA-2013-0128.html
- https://access.redhat.com/security/cve/CVE-2012-3359
- https://access.redhat.com/security/cve/CVE-2013-7347
- https://bugzilla.redhat.com/show_bug.cgi?id=607179
Frequently Asked Questions
What is the severity of REDHAT-BUG-607179?
The severity of REDHAT-BUG-607179 is considered medium due to the potential for session hijacking.
How do I fix REDHAT-BUG-607179?
To mitigate REDHAT-BUG-607179, ensure that session management is handled on the server side rather than relying solely on client-side JavaScript.
What systems are affected by REDHAT-BUG-607179?
REDHAT-BUG-607179 affects the Red Hat Conga system and its Luci web interface.
Can the vulnerability REDHAT-BUG-607179 lead to unauthorized access?
Yes, REDHAT-BUG-607179 can allow an attacker to gain unauthorized access to a user's session if not properly mitigated.
Is there a workaround for REDHAT-BUG-607179?
A possible workaround for REDHAT-BUG-607179 is to instruct users to log out manually before closing their browser tabs.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-3359
- agent/source
- agent/tags
- vendor/red hat
- canonical/conga
- vendor/luci
- canonical/luci