[phplib] URGENT: Crosslinked sessions between MS IE4.01 users From: Pascal Jolin (pjolin <email protected>)
Date: 01/24/01

We discovered this problem about a week ago and I'm at a loss to explain
what's happening. This also happens only to MS IE4 users.

When a user logs in froma fresh MSIE4 browser, and then logs off, and then
logs in again on the same browser (without closing it), the new connection
will
load what appears to be a random session from the active_sessions table
and end up logged as whichever user created that session in the first place.

This obviously is a serious security problem; we've had external users of
our
application end up logged as a system administrator and gain access to
private
company data.

The session / user / perm classes are really off the shelf classes that do
nothing
special other than load some custom info about the user from an extra table.

Is this something that has been reported or heard of before? And perhaps
more important, does anyone have a suggestion to fix that problem? This
only happens with MSIE4. No other version of explorer does that, and the
problem doesn't happen on any version of Netscape, Opera, or any other
browser we have tested.

Regards,

Pascal Jolin

---------------------------------------------------------------------
To unsubscribe, e-mail: phplib-unsubscribe <email protected>
For additional commands, e-mail: phplib-help <email protected>