tomcat session mixing

Question

I'm using Apache Tomcat/6.0.24 running on centos and have several times observed a rare issue in which user sessions are "mixed".
When this occurs, userA clicks on a link and is provided with userB specific content, content that should only be accessible to userB. When this "mixing" occurs, it seems to affect multiple sessions at the same
time, ie userA and userB are not the only ones affected. Restarting tomcat fixed the problem.

Does anyone know what causes this or how to prevent it?

Answer 1

This is caused by an application bug in 99.9% of cases.

There are known issues in 6.0.24 that could cause this. In any case, given the number of security fixes since 6.0.24, an upgrade to 6.0.37 is in order.

Comments

Thanks for the info! I'll look into making the upgrade.

Can you advise how an application bug can cause this when restarting tomcat will fix it? That would help me wrap my mind around something that isn't imaginable, yet.

---

If you store a request object in a session, for example. Another one
is having a servlet-scoped variable that gets set in the
doGet/doPost/etc. method.

There are other ways to shoot yourself in the foot, but these are two
of the most obvious (and common).

Other ways to leak information include, but are not limited to:

- - Sloppy ThreadLocal management
- - Retaining a reference a request or response object
- - Retaining a reference to a servlet Input/OutputStream
- - Retaining a reference to a session

Hope that helps,