CVE-2018-12520 : What You Need to Know

CVE-2018-12520 was published on July 5, 2018, and affects ntopng version 3.4 before 3.4.180617. The vulnerability allows an attacker to hijack user sessions by exploiting the predictable session IDs assigned due to the PRNG not being initialized at program start.

Understanding CVE-2018-12520

This CVE identifies a security flaw in ntopng that enables session hijacking through predictable session IDs.

What is CVE-2018-12520?

An issue in ntopng 3.4 before 3.4.180617 allows attackers to take control of user sessions by leveraging deterministic session ID allocation.

The Impact of CVE-2018-12520

The vulnerability permits attackers to seize user sessions, potentially escalating their privileges by exploiting the deterministic random number generation.

Technical Details of CVE-2018-12520

CVE-2018-12520 involves the following technical aspects:

Vulnerability Description

The PRNG responsible for session ID generation is not initialized at program start.
Predictable session IDs are assigned to active user sessions.

Affected Systems and Versions

ntopng version 3.4 before 3.4.180617 is affected.

Exploitation Mechanism

Attackers with knowledge of the OS, standard library, and targeted user's username can exploit the deterministic random number generation to hijack sessions.

Mitigation and Prevention

To address CVE-2018-12520, consider the following steps:

Immediate Steps to Take

Update ntopng to version 3.4.180617 or later.
Monitor user sessions for any suspicious activity.

Long-Term Security Practices

Implement strong authentication mechanisms.
Regularly audit and review session management processes.

Patching and Updates

Apply patches and updates promptly to mitigate known vulnerabilities.