| commit | f6b6d3bf9d43d45560d352b76c12fe0c87a16fa3 | |
| author | Kai Blin <kai@samba.org> | |
| Mon, 28 Jan 2013 22:13:43 +0000 (28 23:13 +0100) | ||
| committer | Karolin Seeger <kseeger@samba.org> | |
| Tue, 29 Jan 2013 09:52:38 +0000 (29 10:52 +0100) | ||
| tree | 47bae4db6c9e3be214d1844331fcc1ce52f63582 | treesnapshot (tar.gz zip) |
| parent | e9cd10049e0b5c1e24e454cc3277eb4bea033dfb | commitdiff |
swat: Use additional nonce on XSRF protection
If the user had a weak password on the root account of a machine running
SWAT, there still was a chance of being targetted by an XSRF on a
malicious web site targetting the SWAT setup.
Use a random nonce stored in secrets.tdb to close this possible attack
window. Thanks to Jann Horn for reporting this issue.
Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9577: CVE-2013-0214: Potential XSRF in SWAT.
If the user had a weak password on the root account of a machine running
SWAT, there still was a chance of being targetted by an XSRF on a
malicious web site targetting the SWAT setup.
Use a random nonce stored in secrets.tdb to close this possible attack
window. Thanks to Jann Horn for reporting this issue.
Signed-off-by: Kai Blin <kai@samba.org>
Fix bug #9577: CVE-2013-0214: Potential XSRF in SWAT.
| source3/web/cgi.c | diffblobblamehistory | |
| source3/web/swat.c | diffblobblamehistory | |
| source3/web/swat_proto.h | diffblobblamehistory |