Icon of program: Microsoft IIS4 Session ID…

Microsoft IIS4 Session ID Cookie Marking Vulnerability Patch for Windows

Download now

Used Microsoft IIS4 Session ID Cookie Marking Vulnerability Patch for Windows?

Editors’ Review

Download.com staff
This patch eliminates a critical security vulnerability in Microsoft Internet Information Server. It prevents malicious users from hijacking secure web sessions by enhancing ASP's handling of session ID cookies.

Top Recommended Alternative

  • Pros

    • Eliminates a security vulnerability in IIS.
    • Prevents secure web session hijacking.
    • Adds secure session ID cookie support to ASP pages.
    • Enhances protection for sensitive user data.
    • Improves overall web application security for IIS.

  • Cons

    • Previous ASP lacked secure session ID cookie creation.
    • Secure and non-secure pages used the same session ID.
    • Plaintext session ID cookie exchange on non-secure pages.
    • Vulnerability enabled session hijacking under strict conditions.
    • Limited to specific ASP session ID cookie implementation.
Icon of program: Microsoft IIS4 Session ID…

Microsoft IIS4 Session ID Cookie Marking Vulnerability Patch for Windows

Download now

Used Microsoft IIS4 Session ID Cookie Marking Vulnerability Patch for Windows?

Explore More

Full Specifications

GENERAL
Release
Latest update
Version
ms00-080
OPERATING SYSTEMS
Platform
Windows
Operating System
  • Windows 10
  • Windows NT
Additional Requirements
Windows NT 4.0, Internet Information server 4.0
POPULARITY
Total Downloads
2,459
Downloads Last Week
0
Report Software

Last Updated

Developer’s Description

By Microsoft
Eliminate a security vulnerability in Microsoft Internet Information server.
This patch eliminates a security vulnerability in Microsoft Internet Information server that would allow a malicious user to hijack another user's secure Web session under a very restricted set of circumstances.

IIS supports the use of a session ID cookie to track the current session identifier for a Web session. However, ASP in IIS does not support the creation of secure session ID cookies as defined in RFC 2109. As a result, secure and non-secure pages on the same Web site use the same session ID. If a user initiated a session with a secure Web page, a session ID cookie would be generated and sent to the user, protected by SSL. But if the user subsequently visited a non-secure page on the same site, the same session ID cookie would be exchanged, this time in plaintext. If a malicious user had complete control over the communications channel, he could read the plaintext session ID cookie and use it to connect to the user's session with the secure page. At that point, he could take any action on the secure page that the user could take.

The conditions under which this vulnerability could be exploited are rather daunting. The malicious user would need to have complete control over the other user's communications with the Web site. Even then, the malicious user could not make the initial connection to the secure page; only the legitimate user could do that. The patch eliminates the vulnerability by adding support for secure session ID cookies in ASP pages. (Secure cookies already are supported for all other types of cookies, under all other technologies in IIS).

See the FAQ for more information.

Download.com
Your review for Microsoft IIS4 Session ID Cookie Marking Vulnerability Patch