Ogone | Ubercart payment Drupal Module Payment Validation Security Bypass Vulnerability

Bugtraq ID:	40935
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 16 2010 12:00AM
Updated:	Jun 16 2010 12:00AM
Credit:	Kees Kodde
Vulnerable:	Drupal Ogone | Ubercart payment 6.x-1.4 Drupal Ogone | Ubercart payment 5.x-1.5
Not Vulnerable:	Drupal Ogone | Ubercart payment 6.x-1.5 Drupal Ogone | Ubercart payment 5.x-1.6

Ogone | Ubercart payment Drupal Module Payment Validation Security Bypass Vulnerability

The Ogone | Ubercart payment module for Drupal is prone to a security-bypass vulnerability because it fails to properly verify return codes.

Attackers can exploit this issue to bypass security restrictions and cause invalid orders to be processed.

The following are vulnerable:

Ogone | Ubercart payment 5.x prior to 5.x-1.6
Ogone | Ubercart payment 6.x prior to 6.x-1.5

Ogone | Ubercart payment Drupal Module Payment Validation Security Bypass Vulnerability

Solution:
Updates are available; please see the references for details.


Drupal Ogone | Ubercart payment 5.x-1.5

• Drupal uc_ogone-5.x-1.6.tar.gz
  http://ftp.drupal.org/files/projects/uc_ogone-5.x-1.6.tar.gz

Drupal Ogone | Ubercart payment 6.x-1.4

• Drupal uc_ogone-6.x-1.5.tar.gz
  http://ftp.drupal.org/files/projects/uc_ogone-6.x-1.5.tar.gz

Ogone | Ubercart payment Drupal Module Payment Validation Security Bypass Vulnerability

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• Ogone | Ubercart payment Homepage (Drupal)
  
• SA-CONTRIB-2010-062 - Ogone | Ubercart payment - Access Bypass (Drupal)