Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:56719
Return-Path: <yohgaki@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 6025 invoked from network); 2 Dec 2011 09:41:09 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 2 Dec 2011 09:41:09 -0000
Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
X-PHP-List-Original-Sender: yohgaki@gmail.com
X-Host-Fingerprint: 209.85.161.170 mail-gx0-f170.google.com  
Received: from [209.85.161.170] ([209.85.161.170:47362] helo=mail-gx0-f170.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 93/11-33712-33D98DE4 for <internals@lists.php.net>; Fri, 02 Dec 2011 04:41:08 -0500
Received: by ggnv1 with SMTP id v1so2310853ggn.29
        for <internals@lists.php.net>; Fri, 02 Dec 2011 01:41:04 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=mime-version:sender:in-reply-to:references:from:date
         :x-google-sender-auth:message-id:subject:to:content-type;
        bh=vnSpnCxNSirN0UCgadCSovDpy/H9+sIoG3Mr9n6X/No=;
        b=PuxK52huFwAausV1jKqE3ZoA4gUC7h/vV9jYoad6Tcbj6A4ekvGyIKogkL1litmf5R
         4BoQ4PB3HvQU4CZrnqJNAid36OBzjjeYjnASSiPSXT0xYcK6MZBKVw0WEYqxllkXMg8b
         eHwDpUaDPzsb9dwOTv+9CPsdyTVrxUevAn7Lo=
Received: by 10.182.221.72 with SMTP id qc8mr2075181obc.49.1322818864591; Fri,
 02 Dec 2011 01:41:04 -0800 (PST)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Received: by 10.182.55.131 with HTTP; Fri, 2 Dec 2011 01:40:23 -0800 (PST)
In-Reply-To: <CAGa2bXYNTd6_6XUoChrduLOGwQ3+jcoEP8RZtfRQmXju1TGZaA@mail.gmail.com>
References: <CAGa2bXYDbDnTi1aF4Ts9oShyy=2NKPaTc34_+Hg7ZN0v+_MGSQ@mail.gmail.com>
 <4EBDC283.3040700@yahoo.co.jp> <CAGa2bXaMKzQCO=6k4WrB2W3Mp6R8R7oJz7LQBnv_4UKCk0_VxQ@mail.gmail.com>
 <4ED727FB.7030001@uw.no> <CAGa2bXb9k=V1X-jfx5NM=0RrRo2RwxyG6HjaKWLZHLb2Tpe7jQ@mail.gmail.com>
 <4ED76013.50601@lerdorf.com> <CAGa2bXbpqeG1e3t2syWFid1QxTrWimT0=1D5_ujPsJ50PJY20g@mail.gmail.com>
 <CAGa2bXbdc04oorY2G3gnFg9SD57Uokwzrt2EgZ7i0s+E4wARPQ@mail.gmail.com>
 <4ED85560.6040101@uw.no> <CAGa2bXa=OF-sg_eCrRuPDva-O0MxZz25zZJt_rojHDnz5gwrfw@mail.gmail.com>
 <4ED8805B.7070308@uw.no> <CAGa2bXYNTd6_6XUoChrduLOGwQ3+jcoEP8RZtfRQmXju1TGZaA@mail.gmail.com>
Date: Fri, 2 Dec 2011 18:40:23 +0900
X-Google-Sender-Auth: ikbVF-V6yaV-w1UFdaCPfv94otI
Message-ID: <CAGa2bXYcz6NONirwfRmXy_Vc3JZ+0_hdHUM_8hEfp6OgNNoh3g@mail.gmail.com>
To: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Strict session?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi all,

I haven't mentioned, but I'll file CVE for this because this is
exploitable venerability. Unless it is filed by CVE, not many people
would know the risk of adoption/fixation. There may be the entry for
this, though.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net