Drupal Google Authenticator Login Module Access Bypass Vulnerability

Bugtraq ID:	59884
Class:	Access Validation Error
CVE:	CVE-2013-4177
Remote:	Yes
Local:	No
Published:	May 15 2013 12:00AM
Updated:	Aug 01 2013 09:35PM
Credit:	Ivo Van Geertruyen and Lode Vanstechelman
Vulnerable:
Not Vulnerable:

Drupal Google Authenticator Login Module Access Bypass Vulnerability

The Google Authenticator login module for Drupal is prone to an access-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and gain unauthorized access to other user's account.

Google Authenticator login 6.x-1.x versions prior to 6.x-1.2 and 7.x-1.x versions prior to 7.x-1.4 are vulnerable.

Note: The issue described by CVE-2013-4178 has been moved to BID 61568 (Drupal Google Authenticator Login CVE-2013-4178 Module One Time Password Replay Weakness) for better documentation.

Drupal Google Authenticator Login Module Access Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Google Authenticator Login Module Access Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Google Authenticator Login Module Access Bypass Vulnerability

References:

• Drupal Homepage (Drupal)