Drupal Token Authentication Module Authentication Bypass Vulnerability

Bugtraq ID:	34252
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 25 2009 12:00AM
Updated:	Mar 26 2009 07:16PM
Credit:	Stéphane Corlosquet of the Drupal Security Team
Vulnerable:	Drupal Token Authentication 6.x-1.x
Not Vulnerable:	Drupal Token Authentication 6.x-1.1

Drupal Token Authentication Module Authentication Bypass Vulnerability

The Token Authentication module for Durpal is prone to an authentication-bypass vulnerability.

Attackers can exploit this vulnerability to gain unauthorized access to sensitive information that may aid in further attacks.

This issue affects Token Authentication 6.x-1.x prior to 6.x-1.1.

Drupal Token Authentication Module Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

Drupal Token Authentication Module Authentication Bypass Vulnerability

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Drupal Token Authentication 6.x-1.x

• Drupal tokenauth-6.x-1.1.tar.gz
  http://ftp.drupal.org/files/projects/tokenauth-6.x-1.1.tar.gz

Drupal Token Authentication Module Authentication Bypass Vulnerability

References:

• Token Authentication Homepage (Drupal)
  
• SA-CONTRIB-2009-015 - Tokenauth - Access bypass (Drupal)