[Japanese]

JVNDB-2006-000771

Kahua vulnerable in allowing to share login sessions

Overview

Kahua is an open source application development and runtime environment server.
Kahua contains a vulnerability which allows the sharing of sessions among multiple applications which are referring to different user databases.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 4.0 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: High
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: None
Affected Products


Time Intermedia Corporation
  • Kahua Version 0.6 and earlier
  • Kahua CVS version 2006-09-26 and earlier

Impact

A remote attacker could possibly take over the user privileges and manipulate applications when several user databases are in use.

If a multiple applications of Kahua refer to different user database, a user could log into multiple applications which results in a login session to be shared by an unintended user.
Solution

Vendor Information

Time Intermedia Corporation
CWE (What is CWE?)

CVE (What is CVE?)

  1. CVE-2006-5932
References

  1. JVN : JVN#34522909
  2. National Vulnerability Database (NVD) : CVE-2006-5932
  3. Secunia Advisory : SA22785
  4. ISS X-Force Database : 30206
  5. FrSIRT Advisories : FrSIRT/ADV-2006-4486
Revision History

  • [2008/05/21]
      Web page published

Date Public2006/11/10
Date First Published2008/05/21
Date Last Updated2008/05/21