BLUE MOON SECURITY ADVISORY 2011-01

:Title: Insecure secure cookie in web.go
:Severity: Low
:Reporter: Blue Moon Consulting
:Products: web.go
:Fixed in: –

Description

web.go is the simplest way to write web applications in the Go programming language. It's ideal for
writing simple, performant backend web services.

web.go's secure cookie is modeled after Tornado. It suffers the same vulnerability that was documented
in `BMSA 2010-01 <http://www.bluemoon.com.vn/advisories/bmsa201001.html&gt;&#96;_.

This vulnerability is rated at low severity due to situational exploiting conditions.

Workaround

There is no workaround.

Fix

There is no fix at the moment.

Disclosure

Blue Moon Consulting adapts `RFPolicy v2.0 <http://www.wiretrip.net/rfp/policy.html&gt;&#96;_ in notifying
vendors.

:Initial vendor contact:

November 19, 2010: Notice sent to Michael Hoisie.

:Vendor response:

November 20, 2010: Michael replied confirming the bug and promising to update it.

:Further communication:

January 12, 2011: Quick ping sent to Michael to ask for an estimated time of a fix and coordinate an
announcement on January 17.

:Public disclosure: February 25, 2011

:Exploit code:

No exploit code required.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Blue Moon
Consulting Co., Ltd disclaims all warranties, either express or implied, including the warranties of
merchantability and fitness for a particular purpose. Your use of the information on the advisory or
materials linked from the advisory is at your own risk. Blue Moon Consulting Co., Ltd reserves the
right to change or update this notice at any time.