Drupal LoginToboggan Module Unauthorized Access Vulnerability

Bugtraq ID:	34945
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 13 2009 12:00AM
Updated:	May 14 2009 07:06PM
Credit:	Chad Phillips of the Drupal Security Team
Vulnerable:	Drupal LoginToboggan 6.x-1.4
Not Vulnerable:	Drupal LoginToboggan 6.x-1.5

Drupal LoginToboggan Module Unauthorized Access Vulnerability

The Drupal LoginToboggan module is prone to an unauthorized-access vulnerability because it fails to adequately limit access to blocked users in certain circumstances.

An attacker can exploit this vulnerability to gain unauthorized access to the application; other attacks may also possible.

Versions prior to LoginToboggan 6.x-1.5 are vulnerable.

Drupal LoginToboggan Module Unauthorized Access Vulnerability

Attackers may exploit this issue via a browser.

Drupal LoginToboggan Module Unauthorized Access Vulnerability

Solution:
The vendor has released a patch. Please see the references for details.


Drupal LoginToboggan 6.x-1.4

• Drupal logintoboggan-6.x-1.5.tar.gz
  http://ftp.drupal.org/files/projects/logintoboggan-6.x-1.5.tar.gz

Drupal LoginToboggan Module Unauthorized Access Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• LoginToboggan Project Page (Drupal)
  
• SA-CONTRIB-2009-026 - LoginToboggan - Access bypass (Drupal)