session cross between users?
| From: | Leo Márquez | Date: | Wed, 17 Nov 2004 11:47:23 +0000 |
| Subject: | session cross between users? | ||
| Groups: | php.pear.general | ||
| Request: | Send a blank email to pear-general+get-15592@lists.php.net to get a copy of this message | ||
Working with php5 in a multiuser application in some cases the sessions of these users interchange
and the one screen is put to him vice versa to the other. It is a
serious problem because it harms the security of the system.
I'm not sure if is a problem of the configuration of php5 in the servant, of the source code,
bug of php5,
bug of pear package, etc.
I have viewed the bug page of the Auth Package and I see:
Session fixation attack vulnerability
---------------------------------------
On successful authentication using supplied username and password, the
session id should be changed. It would be nice to add an object option
to allow setting this behavior.
Can be my problem caused by this bug?
I say to you what the system uses:
Archive_Tar 1.2 stable
Auth 1.2.3 stable
Config 1.10.2 stable
Console_Getopt 1.2 stable
DB 1.6.8 stable
DB_DataObject 1.7.2 stable
DB_DataObject_FormBuilder 0.10.3 beta
Date 1.4.3 stable
File 1.0.3 stable
HTML_Common 1.2.1 stable
HTML_QuickForm 3.2.4 stable
HTML_Table 1.5 stable
HTML_TreeMenu 1.1.9 stable
Image_Barcode 0.5 stable
Log 1.8.6 stable
PEAR 1.3.2 stable
Translation 1.2.6pl1 stable
XML_Parser 1.2.1 stable
XML_RPC 1.1.0 stable
XML_Util 0.6.1 stable
Thanks
Leo Márquez