Zen Cart v1.2.0-l10n-jp-6 Session Fixation PATCH 2 Released Apr 28, 2007
========================================================================

v1.2.0-l10n-jp-6 $BMQ(B Session Fixation$B@H<e@-BP1~$N%Q%C%A!J=$@5HG!K$G$9!#(B

zip$B%U%!%$%k$NCf?H$O0J2<$K$J$j$^$9!'(B
session_fixation.patch
session_fixation.patch.sql


$B%Q%C%AE,1~<j=g(B
==============

Caution !!
---------------
$B4{$K(Bzen-cart-v1.2-l10n-jp-6-session-fixation-patch.zip$B$rE,1~$7(B
$B$F$$$k>l9g$O(B[$B4{B8%Q%C%A$+$i$N:9J,E,1~(B]$B$r;2>H$7$F$/$@$5$$!#(B
  
Step 1
---------------
session_fixation.path$B$rE,1~$7$^$9!#(B
patch$B%3%^%s%I$,;H$($k4D6-$G!"$+$DFH<+%+%9%?%^%$%:$,9T$o$l$F$$$J$$>l9g$O(B

  $ cd /to/your/shop/root/
  $ patch -p0 < session_fixation.patch

$B$GE,1~$G$-$^$9!#(B
patch$B%3%^%s%I$,;H$($J$$4D6-$d!"FH<+$N%+%9%?%^%$%:$,9T$o$l$F$$$k>l9g$G$O(B
session_fixation.patch$B$NCf?H$r3NG'$7$F<j:n6H$G3F%U%!%$%k$K=$@5$rE,1~(B
$B$9$kI,MW$,$"$j$^$9!#(B

session_fixation.patch$B$K$h$C$F=$@5$5$l$k%U%!%$%k$O$"$J$?$N%7%g%C%W%k!<%H(B
$BG[2<$N0J2<$N#4$D$N%U%!%$%k$G$9!#(B
/admin/includes/application_top.php
/admin/includes/functions/sessions.php
/includes/application_top.php
/includes/functions/sessions.php

Step 2
---------------
session_fixation.patch.sql$B$r%G!<%?%Y!<%9$KBP$7$F<B9T$7$^$9!#(B
$B<B9TJ}K!$O2<5-$r;29M$K$7$F$/$@$5$$!#(B

$B%I%-%e%a%s%H(B / $B%+%9%?%^%$%:(B / $B4pACCN<1(B / SQL$B!)$I$&$d$C$F<B9T$9$k$N!)%W%l%U%#%/%9!)(B
http://zen-cart.jp/pukiwiki/413.html


$B4{B8%Q%C%A$+$i$N:9J,E,1~(B
========================

Caution !!
---------------
$B4{$K(Bzen-cart-v1.2-l10n-jp-6-session-fixation-patch.zip$B$rE,1~$7(B
$B$F$$$k>l9g$O2<5-$N<j=g$r<B9T$7$F$/$@$5$$!#(B

Step 1
---------------
/includes/application_top.php$B$N(B114$B9TL\IU6a!JFH<+%+%9%?%^%$%:$r(B
$B9T$C$F$$$J$1$l$P(B114$B9TL\!K$N(B

  if (SESSION_ALWAYS_FORCE_COOKIE == "True") {

$B$r(B

  if (SESSION_FORCE_COOKIE_USE == "True") {

$B$KJQ99$7$F$/$@$5$$!#(B
/includes/application_top.php$BFb$N(BSESSION_ALWAYS_FORCE_COOKIE$B$r(B
SESSION_FORCE_COOKIE_USE$B$KA4$FCV49$9$k$H$$$&J}K!$G$b$+$^$$$^$;$s!#(B

Step 2
---------------
$B4IM}2hLL$N(B[$B0lHL@_Dj(B]->[$B%;%C%7%g%s4IM}$N@_Dj(B]->[$B%;%C%7%g%s:FH/9T(B]$B$N(B
$BCM$r3NG'$7!"$b$7(BFalse$B$K$J$C$F$$$k>l9g$O(BTrue$B$K$9$k(B


$BBP:v$N>\:Y(B
==========

PHP$B$,(BSession Fixation$B@H<e@-$r;}$C$F$$$k$N$OCN$C$F$$$^$9$+!)(B

  http://phpsec.org/projects/guide/4.html#4.1

$B$b$7!"$"$J$?$N%7%g%C%W$G(BSESSION_FORCE_COOKIE_USE$B$,(BFalse$B;XDj$5$l$F$$$k>l9g!"(B
Zen Cart$B$O(BSession Fixation$B@H<e@-$r;}$C$F$$$^$9!#(B

$BNc$($P(B, Session
Fixation$B$rMxMQ$7$?967bNc$H$7$F<!$N%7%J%j%*$r9M$($k$3$H$,$G$-$^$9!#(B

  $B%7%J%j%*(B
    1. $B967b<T$O(BURL$B$N(BGET$B%Q%i%a!<%?$N(Bzenid$B$K9%$-$JCM$r;XDj$7$F!"$=$N(B
       URL$B$KHo32<T$r%"%/%;%9$5$;$k!#(B
    2. $BHo32<T$,%m%0%$%s$7$?8e!"967b<T$OF1$8(Bzenid$B$rH<$C$F%7%g%C%W$K(B
       $B%"%/%;%9$9$k$3$H$GHo32<T$N%"%+%&%s%H$r$N$C$H$k$3$H$,$G$-$k(B
       (Session Hijacking)

$B$^$?!"F|K\8lHG%3%_%e%K%F%#7G<(HD$G$O2<5-$N$d$j$H$j$,$"$j$^$7$?!#(B
  http://zen-cart.jp/bbs/viewtopic.php?t=3031


$B$3$N@H<e@-$r=$@5$9$k$?$a$K!"K\%Q%C%A$O2<5-$NBP:v$r@9$j9~$s$G$$$^$9!#(B

 - http://phpsec.org/projects/guide/4.html#4.1 $B$rE,1~$9$k(B
 - $B4IM}2hLL$N(B[$B0lHL@_Dj(B]->[$B%;%C%7%g%s4IM}$N@_Dj(B]->[$B%/%C%-!<MxMQ$rI,?\$K$9$k(B]$B$N(B
   $B%G%U%)%k%HCM$r(BTrue$B$K$9$k(B
 - $B4IM}2hLL$N(B[$B0lHL@_Dj(B]->[$B%;%C%7%g%s4IM}$N@_Dj(B]->[$B%;%C%7%g%s:FH/9T(B]$B$N(B
   $B%G%U%)%k%HCM$r(BTrue$B$K$9$k(B
      $B"((B $B$b$7!"$"$J$?$N%7%g%C%W$G(BFalse$B$,;XDj$5$l$F$$$k$J$i!"(BTrue$B;XDj$K@Z$jBX(B
         $B$($F$/$@$5$$!#(B
 - $B4IM}2hLL$N(B[$B0lHL@_Dj(B]->[$B%;%C%7%g%s4IM}$N@_Dj(B]->[$B%/%C%-!<MxMQ$rI,?\$K$9$k(B]$B$N(B
   $BCM$r(BTrue$B$K$7$?:]$K!"(Bini_set$B$K$h$C$F(BPHP$B$,%;%C%7%g%s$r(BCookie$B$rI,$:;H$C$F(B
   $BAw<u?.$9$k$3$H$r6/@)$9$k(B
      $B"((B $B$3$N=$@5HG%Q%C%A$O$3$N(B3$BHVL\$NBP:v$,>e<j$/9T$($F$$$J$+$C$?$?$a(B
         $B$=$N=$@5$r@9$j9~$s$@$b$N$G$9!#(B


$BCm0U(B
====

$B$3$N%Q%C%A$NE,1~$O<+8J@UG$$G9T$C$F$/$@$5$$!#(B
$B$^$?!"$3$N%Q%C%A$rE,1~$9$kA0$K$"$J$?$N%7%9%F%`$r%P%C%/%"%C%W(B
$B$9$k$3$H$rK:$l$J$$$G$/$@$5$$!#(B


                                         Zen-Cart.JP <dev@zen-cart.jp>
