| commit | 91f4275873ebeda8f57684f09df67162ae80515a | |
| author | Kai Blin <kai@samba.org> | |
| Mon, 28 Jan 2013 20:41:07 +0000 (28 21:41 +0100) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Tue, 29 Jan 2013 08:49:31 +0000 (29 09:49 +0100) | ||
| tree | 306cbae9414b4e2b157a6f688286eab123d5c970 | treesnapshot (tar.gz zip) |
| parent | 71225948a249f079120282740fcc39fd6faa880e | commitdiff |
swat: Use additional nonce on XSRF protection
If the user had a weak password on the root account of a machine running
SWAT, there still was a chance of being targetted by an XSRF on a
malicious web site targetting the SWAT setup.
Use a random nonce stored in secrets.tdb to close this possible attack
window. Thanks to Jann Horn for reporting this issue.
Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9577: CVE-2013-0214: Potential XSRF in SWAT.
If the user had a weak password on the root account of a machine running
SWAT, there still was a chance of being targetted by an XSRF on a
malicious web site targetting the SWAT setup.
Use a random nonce stored in secrets.tdb to close this possible attack
window. Thanks to Jann Horn for reporting this issue.
Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9577: CVE-2013-0214: Potential XSRF in SWAT.
| source3/web/cgi.c | diffblobblamehistory | |
| source3/web/swat.c | diffblobblamehistory | |
| source3/web/swat_proto.h | diffblobblamehistory |