Icon of program: Microsoft IIS5 Session ID…

Microsoft IIS5 Session ID Cookie Marking Vulnerability Patch for Windows

Used Microsoft IIS5 Session ID Cookie Marking Vulnerability Patch for Windows?

Download.com has chosen not to provide a direct-download link for this product and offers this page for informational purposes only.

Editors’ Review

Download.com staff
This Microsoft patch addresses a specific security vulnerability in Internet Information Services. It prevents a rare scenario where a malicious user could hijack a secure web session.

Top Recommended Alternative

  • Pros

    • Eliminates a specific security vulnerability.
    • Adds support for secure Session ID cookies in ASP pages.
    • Protects against session hijacking under restricted circumstances.

  • Cons

    • Addresses a very restricted set of circumstances.
    • Exploitation requires complete control over the communications channel.
Icon of program: Microsoft IIS5 Session ID…

Microsoft IIS5 Session ID Cookie Marking Vulnerability Patch for Windows

Used Microsoft IIS5 Session ID Cookie Marking Vulnerability Patch for Windows?

Explore More

Full Specifications

GENERAL
Release
Latest update
Version
ms00-080
OPERATING SYSTEMS
Platform
Windows
Operating System
  • Windows 10
  • Windows 2000
Additional Requirements
Windows 2000, Internet Information server 5.0
POPULARITY
Total Downloads
22,814
Downloads Last Week
0
Report Software

Program available in other languages

Last Updated

Developer’s Description

By Microsoft
Eliminate a security vulnerability in Microsoft Internet Information server.
This patch eliminates a security vulnerability in Microsoft Internet Information server that would allow a malicious user to hijack another user's secure Web session under a very restricted set of circumstances.

IIS supports the use of a Session ID cookie to track the current session identifier for a Web session. However, ASP in IIS does not support the creation of secure Session ID cookies as defined in RFC 2109. As a result, secure and non-secure pages on the same Web site use the same session ID. If a user initiated a session with a secure Web page, a session ID cookie would be generated and sent to the user, protected by SSL. But if the user subsequently visited a non-secure page on the same site, the same session ID cookie would be exchanged, this time in plaintext. If a malicious user had complete control over the communications channel, he could read the plaintext session ID cookie and use it to connect to the user's session with the secure page. At that point, he could take any action on the secure page that the user could take.

The conditions under which this vulnerability could be exploited are rather daunting. The malicious user would need to have complete control over the other user's communications with the Web site. Even then, the malicious user could not make the initial connection to the secure page; only the legitimate user could do that. The patch eliminates the vulnerability by adding support for secure Session ID cookies in ASP pages. (Secure cookies already are supported for all other types of cookies, under all other technologies in IIS).

Read the FAQ for more information.

Download.com
Your review for Microsoft IIS5 Session ID Cookie Marking Vulnerability Patch