Snitz Forum Cookie Authentication Bypass Vulnerability

Bugtraq ID:	7924
Class:	Design Error
CVE:	CVE-2003-0493
Remote:	Yes
Local:	No
Published:	Jun 16 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Discovery of this vulnerability has been credited to JeiAr <[email protected]>.
Vulnerable:	Snitz Forums 2000 Snitz Forums 2000 3.4 .03
Not Vulnerable:

Snitz Forum Cookie Authentication Bypass Vulnerability

Snitz Forum has been reported prone to a cookie authentication bypass vulnerability.

It has been reported that, if a remote attacker can retrieve the authentication cookie of another user, they can extract the password hash and use it to hijack another Snitz forum users account.

This issue was reported in Snitz Forums 3.4.0.3, other versions might also be affected.

Snitz Forum Cookie Authentication Bypass Vulnerability

There is no exploit required.

Snitz Forum Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Snitz Forum Cookie Authentication Bypass Vulnerability

References:

• Snitz Forums 2000 Homepage (Snitz Forums 2000)
  
• Multiple Vulnerabilities In Snitz Forums (JeiAr )