CVE-2012-3359
published 2014-03-31CVE-2012-3359: Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges…
PriorityP412low3.7CVSS 2.0
AVLACHAuNCPIPAP
EPSS
0.34%
26.2th percentile
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv2.03.7LOWAV:L/AC:H/Au:N/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
conga: insecure handling of luci web interface sessions
vendor_redhat·2013-01-07·CVSS 3.7
CVE-2013-7347 [LOW] conga: insecure handling of luci web interface sessions
conga: insecure handling of luci web interface sessions
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
Package: conga (Red Hat Enterprise Linux 5) - Affected
Red Hat
conga: insecure handling of luci web interface sessions
vendor_redhat·2013-01-07·CVSS 3.7
CVE-2012-3359 [LOW] conga: insecure handling of luci web interface sessions
conga: insecure handling of luci web interface sessions
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
It was discovered that luci stored usernames and passwords in session cookies. This issue prevented the session inactivity timeout feature from working correctly, and allowed attackers able to get access to a session cookie to obtain the victim's authentication credentials.
Package: conga (Red Hat Enterprise Linux 5) - Affected
Red Hat
kernel: b43: allocate receive buffers big enough for max frame len + offset
vendor_redhat·2011-03-27·CVSS 7.5
CVE-2011-3359 [HIGH] kernel: b43: allocate receive buffers big enough for max frame len + offset
kernel: b43: allocate receive buffers big enough for max frame len + offset
The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which allows remote attackers to cause a denial of service (system crash) via a crafted frame.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 4 and 5 as they did not provide support for Broadcom 43xx wireless devices. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1465.html, and https://rhn.redhat.com/errata/RHSA-2012-0010.html.
Package: kernel (Red Hat Enterprise Linux 4) - Not affected
Package: kernel (Red Hat Enterprise Linux 5) - Not affe
GHSA
GHSA-865x-x787-2cjj: Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain pr
ghsa_unreviewed·2022-05-17·CVSS 3.7
CVE-2012-3359 [LOW] GHSA-865x-x787-2cjj: Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain pr
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
GHSA
GHSA-9fpf-6wcx-rjjm: Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __a
ghsa_unreviewed·2022-05-17·CVSS 3.7
CVE-2013-7347 [LOW] GHSA-9fpf-6wcx-rjjm: Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __a
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
No detection rules found.
No public exploits indexed.
2014-03-31
Published