mcNews Falsified Cookies Vulnerability

Bugtraq ID:	4771
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 17 2002 12:00AM
Updated:	May 17 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	McNews McNews 1.2 McNews McNews 1.1 a McNews McNews 1.1 McNews McNews 1.0
Not Vulnerable:

mcNews Falsified Cookies Vulnerability

mcNews is a set of scripts for allowing users to post news stories on a webpage. It will run on most Linux and Unix variants as well as Microsoft Windows operating systems.

mcNews does not sufficiently validate the information contained within cookie-based authentication credentials. As a result, it is trivial for a remote attacker to falsify an administrative cookie which will be accepted as a valid authentication credential.

mcNews Falsified Cookies Vulnerability

There is no exploit code required.

mcNews Falsified Cookies Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

mcNews Falsified Cookies Vulnerability

References:

• mcNews Homepage (mcNews)
  
• Security holes : mcNews (frog frog )