Secure testing team - Dec 2010 - Bug#608286: CVE-2010-4312: does not use HTTPOnly for session cookies by default

Package: tomcat6
Severity: serious
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for tomcat6.

CVE-2010-4312[0]:
| The default configuration of Apache Tomcat 6.x does not include the
| HTTPOnly flag in a Set-Cookie header, which makes it easier for remote
| attackers to hijack a session via script access to a cookie.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4312
    http://security-tracker.debian.org/tracker/CVE-2010-4312


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAk0bcAIACgkQNxpp46476aob7wCeK2joFZ0VfbEB2bXj5TX1B3IC
DJQAoIO6Kda29+lblIBOTMgPm8xsTB5q
=/b1G
-----END PGP SIGNATURE-----