Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2009-1629

Published: 14/05/2009 Updated: 10/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Ajaxterm

Vulnerability Summary

ajaxterm.js in AjaxTerm 0.10 and previous versions generates session IDs with predictable random numbers based on certain JavaScript functions, which makes it easier for remote malicious users to (1) hijack a session or (2) cause a denial of service (session ID exhaustion) via a brute-force attack.

Vulnerable Product Search on Vulmon Subscribe to Product

antony lesuisse ajaxterm

antony lesuisse ajaxterm 0.7

antony lesuisse ajaxterm 0.6

antony lesuisse ajaxterm 0.8

antony lesuisse ajaxterm 0.9

Vendor Advisories

Debian CVElist Bug Report Logs: CVE-2009-1629: generates session IDs with predictable random numbers
Debian Bug report logs - #528938 CVE-2009-1629: generates session IDs with predictable random numbers Package: ajaxterm; Maintainer for ajaxterm is Debian QA Group <packages@qadebianorg>; Source for ajaxterm is src:ajaxterm (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Sat, 16 Ma ...
Debian Security Advisories: DSA-1994-1 ajaxterm -- weak session IDs
It was discovered that Ajaxterm, a web-based terminal, generates weak and predictable session IDs, which might be used to hijack a session or cause a denial of service attack on a system that uses Ajaxterm For the oldstable distribution (etch), the problem has been fixed in version 09-2+etch1 For the stable distribution (lenny), the problem has ...

References

CWE-287http://www.ocert.org/advisories/ocert-2009-004.htmlhttp://www.openwall.com/lists/oss-security/2009/05/11/1http://www.securityfocus.com/bid/34903http://secunia.com/advisories/42784http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052655.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/50464http://www.securityfocus.com/archive/1/503421/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=528938https://nvd.nist.govhttps://www.debian.org/security/./dsa-1994
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionSSRFbuffer overflowCVE-2023-28952CVE-2023-41822CVE-2024-27956CVE-2023-7028CVE-2024-34447CVE-2024-34460
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook