oss-sec mailing list archives
Re: CVE request for Drupal contributed modules
From: Forest Monsen <forest.monsen () gmail com>
Date: Mon, 20 Jan 2014 23:12:41 -0800
On Mon, Jan 20, 2014 at 8:32 AM, <cve-assign () mitre org> wrote:
The advisory says "attacker must have access to the original session ID of the victim." Do you know whether the relevant attacks occur at times when this original session ID is invalid?
I'm going to interpret your question as "Do you know whether the relevant attacks [can] occur at times when this original session ID is invalid?" On reviewing the vulnerability discussion, it seems clear that no, the attack can not succeed if the original session ID is invalid. And this is the point of the patch addressing the issue; when logging in a new user after a purchase, the session is now regenerated with user_login_finalize (Drupal 7, http://drupalcode.org/project/ubercart.git/blobdiff/f210d304fc6e7c1758fc7822a5eeab0b93016b77..0f715a22aef41d6e1e3b94d922a2930eae2706c5:/uc_cart/uc_cart.module) or user_external_login (Drupal 6, http://drupalcode.org/project/ubercart.git/blobdiff/e35463375646fbcc6953f6046de596300801181f..4784812f9e65b8bf27ae73b5cc522abdc2afb422:/uc_cart/uc_cart.module).
Current thread:
- CVE request for Drupal contributed modules Forest Monsen (Jan 20)
- Re: CVE request for Drupal contributed modules Henri Salo (Jan 20)
- Re: CVE request for Drupal contributed modules cve-assign (Jan 20)
- Re: CVE request for Drupal contributed modules Forest Monsen (Jan 20)