Perl Store-able objects

--===============8694484573216776215==
Content-Type: multipart/alternative; boundary=001a114a7b5c6a660a054766f0b3

--001a114a7b5c6a660a054766f0b3
Content-Type: text/plain; charset=UTF-8

Hi All, This may not be a Mason issue, but I have a security report stating
the following:

"Your app no longer use any of the Perl Storable Object cookies (cn, dn,
changetoken) to keep state or perform authentication actions.  However, the
underlying Perl Mason application framework will still process the data in
these cookies as Storable objects if they are included in user requests.
As a result, it is still possible to trigger exploitation."

*Remediation:   *Do not process any cookies in user requests as Perl
Storable objects.


Looking for any guidance, clarity, or theories on the statement (high level
of just where to look or what is it I might look for in the code). This
application was written a long time ago by someone else, and I'm just
trying to keep it running.


Thanks in advance,



-- 
Hiram Gibbard
[email protected]
http://hiramgibbard.com

--001a114a7b5c6a660a054766f0b3
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi All, This may not be a Mason issue, but I have a securi=
ty report stating the following:<div><br></div><div><span style=3D"font-siz=
e:11pt;font-family:calibri,sans-serif;color:black">&quot;Your app no longer=
 use any of the Perl Storable Object
cookies (cn, dn, changetoken) to keep state or perform authentication
actions.=C2=A0 However, the underlying Perl Mason application framework wil=
l
still process the data in these cookies as Storable objects if they are
included in user requests.=C2=A0 As a result, it is still possible to trigg=
er
exploitation.&quot;</span></div><div><font color=3D"#000000" face=3D"calibr=
i, sans-serif"><span style=3D"font-size:14.6667px"><br></span></font></div>=
<div><p class=3D"MsoNormal"><b><span style=3D"color:black">Remediation:=C2=
=A0 =C2=A0</span></b><span style=3D"color:black">Do not process any cookies=
 in user requests as Perl
Storable objects.<span></span></span></p><p class=3D"MsoNormal"><span style=
=3D"color:black"><br></span></p><p class=3D"MsoNormal"><font color=3D"#0000=
00">Looking for any guidance, clarity, or theories on the=C2=A0statement (h=
igh level of just where to look or what is it I might look for in the code)=
. This application=C2=A0was written a long time ago by someone else, and I&=
#39;m just trying to keep it running.</font></p><p class=3D"MsoNormal"><fon=
t color=3D"#000000"><br></font></p><p class=3D"MsoNormal"><font color=3D"#0=
00000">Thanks in advance,</font></p><p class=3D"MsoNormal"><font color=3D"#=
000000"><br></font></p><div><br></div>-- <br><div class=3D"gmail_signature"=
><div dir=3D"ltr"><div>Hiram Gibbard<br><a href=3D"mailto:[email protected]=
m" target=3D"_blank">[email protected]</a></div><div><a href=3D"http://hir=
amgibbard.com" target=3D"_blank">http://hiramgibbard.com</a></div><div><br>=
<div style=3D"display:inline"></div></div></div></div>
</div></div>

--001a114a7b5c6a660a054766f0b3--


--===============8694484573216776215==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
--===============8694484573216776215==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Mason-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mason-users

--===============8694484573216776215==--