Set Cookie Header Caching Vulnerability

A vulnerability exists in Microsoft® Site Server® and Microsoft Commercial Internet System® (MCIS) that could allow a web site visitor to inadvertently access another customer's data, if their Internet gateway caches web pages via a proxy server and the web site authenticates based on a GUID.

Issue

When certain versions of Site Server or MCIS send a web page that contains a Set Cookie Header, they do not flag the page with an expiration header. As a result, such pages may be cached by a web proxy. Multiple customers accessing the same site via a web proxy might be served the same page, containing the same Set Cookie Header. If the cookie information includes a GUID that is used as an index for the server's database, one customer's personal data might be viewable by the others.

When GUIDs are issued to new clients as part of the authentication process, they can be presumed to be unique. However, they cannot be presumed to be secret. The patch eliminates the specific vulnerability at hand, but other attacks are possible whenever authentication is based solely on information contained in cookies. Sites that follow security best practices, such as turning off automatic cookie authentication, would not be affected by this vulnerability.

Affected Products

• Microsoft Site Server 3.0 and Commercial Internet System 2.0 and 2.5

Download

Patch: ftp://ftp.microsoft.com/bussys/sitesrv/sitesrv-public/fixes/usa/siteserver3/Hotfixes-PostSP2/ProxyCache/

Further Details

Source: Microsoft Corporation

Reference: Microsoft Corporation

Updated: September 10, 1999

>> Recommended Download - secure your PC from spyware, adware and malware now with Spyware Doctor <<