MakeBid Auction Deluxe Plaintext Cookie Vulnerability

Bugtraq ID:	4070
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 09 2002 12:00AM
Updated:	Feb 09 2002 12:00AM
Credit:	This vulnerability was submitted to BugTraq on February 9th, 2002 by Blake Frantz <[email protected]>.
Vulnerable:	USANet Creations MakeBid Auction Deluxe 3.30 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17
Not Vulnerable:

MakeBid Auction Deluxe Plaintext Cookie Vulnerability

MakeBid Auction Deluxe is software for hosting real-time auctions on a website. It is written in Perl and will run on most Unix and Linux variants.

MakeBid Auction Deluxe stores authentication credentials in plaintext in cookies.

BugTraq ID 4069 "MakeBid Auction Deluxe Cross-Site Scripting Vulnerability" describes an issue which allows a remote attacker to steal cookies from legitimate users of the service. In combination with this issue, an attacker is able to access auction accounts of other legitimate users.

MakeBid Auction Deluxe Plaintext Cookie Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MakeBid Auction Deluxe Plaintext Cookie Vulnerability

References:

• MakeBid Auction Deluxe Product Page (USANet Creations)