Re: Bigfoot/Bellsouth Webmail bug

[rmadere () STEI COM (Madere, Russel)]

Yes.  I logged out immediately loaded the cached page and just hit the Login
button again and got right in.  On another machine, I logged in and logged
out.  I let the browser site for 1 hour and repeated the previous
experiment, I repeated with 2 and 3 hour intervals as well.  Each time, I
was able to simply hit the Login button and log in.

Russel

                -----Original Message-----
                From:   James Nerlinger, Jr. [mailto:jnj () AIS-BBS ORG]
                Sent:   Friday, January 08, 1999 11:58 AM
                To:     BUGTRAQ () NETSPACE ORG
                Subject:        Re: Bigfoot/Bellsouth Webmail bug

                >I seem to have found another "bug" with the
Bigfoot/Bellsouth Webmail.
                >Users can log back into the service from cached pages.
This is a huge
                >security hole, especially for users access these services
from public
                >terminals.  Subsequent users can just use the back button
to go back in the
                >previous session history and log in as the previous user.


                This is not uncommon in web based email & conferencing
packages, however,
                most are authored to only allow this for a certain amount of
time and to
                disregard the attempt if the user logged out properly.  Out
of curiosity,
                did you test this with the two variables of time and a
logout?

                James