OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Link | Tags |
---|---|
http://www.osvdb.org/3936 | vdb entry broken link |