Bug 922233 (CVE-2013-7436) - VUL-0: CVE-2013-7436: novnc: session hijack through insecurely set session token cookies
Summary: VUL-0: CVE-2013-7436: novnc: session hijack through insecurely set session to...
Status: RESOLVED FIXED
Alias: CVE-2013-7436
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2015-03-27
Assignee: Bernhard Wiedemann
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/114715/
Whiteboard: CVSSv2:SUSE:CVE-2013-7436:8.5:(AV:N/...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-13 10:12 UTC by Andreas Stieger
Modified: 2022-02-13 11:07 UTC (History)
7 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-03-13 10:12:47 UTC
novnc may set a cookie without the secure flag set. This may cause the cookie to be also sent for requests to non-secure connections, thus leaking session data.

From the upstream commit:
Adds support for secure attribute on token cookie

This patch adds support for the secure attribute on token
cookies (sent by nova-novncproxy). If the https is used
to transfer the cookie, the secure attribute is set thus
restricting server requestes to secure conections only.
This should prevent man-in-the-middle attacks.

https://github.com/kanaka/noVNC/commit/ad941faddead705cd611921730054767a0b32dcd

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7436
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-7436.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778618
https://bugzilla.redhat.com/show_bug.cgi?id=1193451
Comment 1 Swamp Workflow Management 2015-03-13 10:16:45 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-03-27.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/61101
Comment 2 Swamp Workflow Management 2015-03-13 23:01:00 UTC
bugbot adjusting priority
Comment 3 Vincent Untz 2015-03-17 08:42:56 UTC
I think both Cloud 4 and Cloud 5 are affected.
Comment 4 Bernhard Wiedemann 2015-03-17 13:28:48 UTC
added to
Cloud:OpenStack:Icehouse/novnc
Cloud:OpenStack:Juno/novnc
Comment 18 Berthold Gunreben 2015-07-02 13:42:23 UTC
I had the package excluded when trying to check the patchinfo in. However the patchinfo vanished, so probably someone else cared.
Comment 19 Andreas Stieger 2015-07-27 16:03:59 UTC
Not pursuing Cloud 4 update.
Releasing Cloud 5 update, this should exhaust this issue.
Comment 20 Swamp Workflow Management 2015-07-27 20:07:40 UTC
SUSE-SU-2015:1300-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 922233
CVE References: CVE-2013-7436
Sources used:
SUSE Cloud 5 (src):    novnc-0.4-0.13.1
Comment 21 Andreas Stieger 2015-07-28 08:03:52 UTC
all released