| VID |
21819 |
| Severity |
30 |
| Port |
80, ... |
| Protocol |
TCP |
| Class |
CGI |
| Detailed Description |
The Web server has a Web page using Persistent Cookie. A "cookie" is a small piece of information which a web server can store temporarily with your web browser. This is useful for having your browser remember some specific information which the web server can later retrieve. Cookies generally fall into one of two categories: persistent or session. Persistent cookies are stored on a user's hard disk until it expires (persistent cookies are set with expiration dates) or until the user deletes the cookies. Persistent cookies are used to collect identifying information about the user, such as Web surfing behavior or user preferences for a specific Web site. In contrast session cookies (or non-persistent cookies) just live in the user browser's memory. They can be used by a web server only until you close your browser. In many cases such as public computer (e.g., in a public library or in a computer lab at a university), older operating systems, and user failure to lock a computer when leaving, if user does not log out even if the browser is closed down, and if cookie was containing authentication information. the Web site is kept in logged in state until expiration time even if do not log in again.
* References:
http://www.webreference.com/javascript/961125/source.html
* Platforms Affected:
Any HTTP server Any version
Any operating system Any version |
| Recommendation |
Use Session Cookie or Remove 'Expires=' tag from the HTTP header SetCookie.
e.g.)
<?
$login_info = "value...";
setcookie("SECUIID", $login_info, time()+3600);
?>
Modify the upper lines as follows:
<?
session_start();
$login_info="foo var";
session_register("login_info");
?>
-- OR --
<?
$login_info = "value...";
setcookie("SECUIID", $login_info, NULL);
?> |
| Related URL |
(CVE) |
| Related URL |
(SecurityFocus) |
| Related URL |
(ISS) |
|
