Geeklog Permanent Cookie Account Hijacking Vulnerability
BID:3844
Info
Geeklog Permanent Cookie Account Hijacking Vulnerability
| Bugtraq ID: | 3844 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2002 12:00AM |
| Updated: | Jan 10 2002 12:00AM |
| Credit: | This vulnerability was posted to BugTraq on January 10th, 2002 by Adrian Chung <[email protected]>. |
| Vulnerable: |
Geeklog Geeklog 1.3 |
| Not Vulnerable: | |
Discussion
Geeklog Permanent Cookie Account Hijacking Vulnerability
Geeklog is freely available, open-source weblog software. It allows users to create a virtual community area, complete with user administration, story posting, etc. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000. Geeklog is backended by MySQL.
Geeklog can be configured to issue a permanent cookie. This cookie is used as an authentication credential during future visits to the site running Geeklog. The cookie contains a UID, which Geeklog uses to determine which user to authenticate. It is possible to edit the UID in the cookie to that of another user to gain access to their account.
This issue can be exploited to gain an administrative account with the service.
This vulnerability was introduced into Geeklog 1.3 as an oversight in design.
Geeklog is freely available, open-source weblog software. It allows users to create a virtual community area, complete with user administration, story posting, etc. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000. Geeklog is backended by MySQL.
Geeklog can be configured to issue a permanent cookie. This cookie is used as an authentication credential during future visits to the site running Geeklog. The cookie contains a UID, which Geeklog uses to determine which user to authenticate. It is possible to edit the UID in the cookie to that of another user to gain access to their account.
This issue can be exploited to gain an administrative account with the service.
This vulnerability was introduced into Geeklog 1.3 as an oversight in design.
Exploit / POC
Geeklog Permanent Cookie Account Hijacking Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
Geeklog Permanent Cookie Account Hijacking Vulnerability
Solution:
The vendor has acknowledged this issue and suggests the following fix:
If you are running Geeklog 1.3 you will need to go to CVS and download the latest copies of system/lib-sessions.php and public_html/users.php.
Additional information is available at the Geeklog homepage(http://geeklog.sourceforge.net/).
Solution:
The vendor has acknowledged this issue and suggests the following fix:
If you are running Geeklog 1.3 you will need to go to CVS and download the latest copies of system/lib-sessions.php and public_html/users.php.
Additional information is available at the Geeklog homepage(http://geeklog.sourceforge.net/).