Drupal Pubcookie.Module Authentication Bypass Vulnerability

Bugtraq ID:	19920
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2006 12:00AM
Updated:	Sep 08 2006 09:32PM
Credit:	Eric Drechsel has been credited with the discovery of this vulnerability.
Vulnerable:	Pubcookie Pubcookie module for Drupal 4.7 .1.2.2.4 2006/09/07 Pubcookie Pubcookie module for Drupal 4.6 1.2.2.4 2006/09/07
Not Vulnerable:	Pubcookie Pubcookie module for Drupal 4.7 Pubcookie Pubcookie module for Drupal 4.6

Drupal Pubcookie.Module Authentication Bypass Vulnerability

The Pubcookie module for Drupal is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to gain administrative access to the affected application. This may lead to other attacks.

Version 4.6 CVS ID 1.2.2.4 2006/09/07 and version 4.7 CVS ID 1.2.2.4 2006/09/07 are vulnerable to this issue. Other versions may also be affected.

Drupal Pubcookie.Module Authentication Bypass Vulnerability

Attackers can exploit these issues via a web client.

Drupal Pubcookie.Module Authentication Bypass Vulnerability

Solution:
The vendor has released fixes for versions 4.6 and 4.7; please see the references for more information.


Pubcookie Pubcookie module for Drupal 4.6 1.2.2.4 2006/09/07

• Drupal pubcookie-4.6.0.tar.gz
  http://ftp.osuosl.org/pub/drupal/files/projects/pubcookie-4.6.0.tar.gz

Drupal Pubcookie.Module Authentication Bypass Vulnerability

References:

• Drupal Modules Home Page (Drupal)