Are Access Manager Agents susceptible to Session Fixation attacks?
3 years ago
Originally Published: 2009-05-26
Article Number
000057171
Applies To
RSA Access Manager Agent 4.8 for IIS 6.0
RSA Access Manager 4.8 Agent for Apache 2.2

IBM Rational Appscan
Issue
Are Access Manager Agents susceptible to Session Fixation attacks?
IBM Rational Appscan report for the Access Manger Login pages were identified as potentially vulnerable for the reason ?Session Identifier Not Updated?.
Cause
The Appscan tool reports the logon pages as vulnerable due to the presence of the JSESSIONID in the request object.  The JSESSIONID is generated by the application server if the logon pages are JSP and the JSP is being served from an application server.
Resolution
RSA Access Manger agents are not directly susceptible to Session Fixation attacks.   RSA Access Manger uses its own encrypted session cookie called CTSESSION to maintain the logon state of the user.  This session cookie is set during the logon process and cleared during logout.
For more information on Session Fixation Attacks see http://capec.mitre.org/data/definitions/60.html
Don't see what you're looking for?