CVE-2020-11729: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through version 0.60, identified as CVE-2020-11729. The vulnerability relates to long-term session cookies used for session continuity, which were not being generated securely. This security flaw was disclosed in April 2020 and affects all versions of AWL up to and including 0.60 (Debian Security, Debian LTS).

The vulnerability stems from insecure implementation of the LSIDLogin() function, where the validation used for the lsid cookie could be spoofed. The issue arises because the validation string components (user_no, username, and password) are either known or easily guessable, particularly in cases where LDAP authentication is used or for new users. Additionally, the salt, which should provide security, is user-selectable, allowing attackers to choose any value when computing their attack (GitLab Issue).

The vulnerability enables a brute-force attack that may be successful in compromising user sessions. Furthermore, the design flaw in the lsid cookie means that sessions have no timeout mechanism and last indefinitely. This means that logout relies solely on the browser destroying the cookie, with no server-side way to invalidate a cookie once issued, except by changing the password. If a cookie is stolen (e.g., through XSS attacks), it can be reused indefinitely (GitLab Issue).

The vulnerability is exploitable by attackers who can guess or obtain user information. The attack vector is particularly concerning because it requires only knowledge of predictable information: the user number (which is displayed in internal pages), usernames (which are often easily guessable), and the ability to choose the salt value (GitLab Issue).

The issue has been fixed in multiple versions across different distributions: version 0.61-1 for unstable, 0.60-1+deb10u1 for Debian Buster, 0.57-1+deb9u1 for Debian Stretch, and 0.55-1+deb8u1 for Debian Jessie. Users are strongly recommended to upgrade their AWL packages to these patched versions (Debian Security, Debian LTS).