[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CABbbngAEqn=u0RNKdfqFA9z-85aCos8U6uVkJrPjGMPWW=E7jA@mail.gmail.com>
Date: Mon, 20 Jan 2014 23:12:41 -0800
From: Forest Monsen <forest.monsen@...il.com>
To: Mitre CVE assign department <cve-assign@...re.org>
Cc: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE request for Drupal contributed modules
On Mon, Jan 20, 2014 at 8:32 AM, <cve-assign@...re.org> wrote:
> The advisory says "attacker must have access to the
> original session ID of the victim." Do you know whether the relevant
> attacks occur at times when this original session ID is invalid?
>
I'm going to interpret your question as "Do you know whether the relevant
attacks [can] occur at times when this original session ID is invalid?"
On reviewing the vulnerability discussion, it seems clear that no, the
attack can not succeed if the original session ID is invalid. And this is
the point of the patch addressing the issue; when logging in a new user
after a purchase, the session is now regenerated with user_login_finalize
(Drupal 7,
http://drupalcode.org/project/ubercart.git/blobdiff/f210d304fc6e7c1758fc7822a5eeab0b93016b77..0f715a22aef41d6e1e3b94d922a2930eae2706c5:/uc_cart/uc_cart.module)
or user_external_login (Drupal 6,
http://drupalcode.org/project/ubercart.git/blobdiff/e35463375646fbcc6953f6046de596300801181f..4784812f9e65b8bf27ae73b5cc522abdc2afb422:/uc_cart/uc_cart.module).
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
