oss-security - CVE Request: WebAuth: Authentication credential disclosure

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 16 May 2013 20:58:16 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: OSS Security Mailinglist <oss-security@...ts.openwall.com>
Cc: Russ Allbery <rra@...ian.org>
Subject: CVE Request: WebAuth: Authentication credential disclosure

Hi Kurt

Could a CVE be assigned for this issue in WebAuth (Cc'ing Russ
Allbery):

----cut---------cut---------cut---------cut---------cut---------cut-----
WebAuth 4.4.1 was changed to use a persistent CGI::Application object
for the WebLogin application when run under FastCGI. However,
CGI::Application does not reset header state automatically between
FastCGI requests, and WebLogin was not modified to do so. In most
situations, this caused no problems, since WebLogin overrode the
previous header state with new values when answering the request.
However, it did not do so when redirecting a user for REMOTE_USER
authentication using the $REMUSER_REDIRECT WebLogin option.

Therefore, if WebLogin were configured with the $REMUSER_REDIRECT
option and running under FastCGI, a user using REMOTE_USER
authentication may receive WebLogin cookies intended for a previous
user of the same FastCGI login.fcgi process, enabling them to
authenticate to other web sites as the previous user.
----cut---------cut---------cut---------cut---------cut---------cut-----

Upstream advisory:

 [1] http://webauth.stanford.edu/security/2013-05-15.html

Versions affected: 4.4.1 through 4.5.2
Versions fixed:	   4.5.3 and later

Upstream patch for the issue is referenced at [2].

 [2] http://webauth.stanford.edu/security/2013-05-15.patch

Even tought advisory says "For Debian and Ubuntu users, all versions
of WebAuth with this vulnerability were only uploaded to Debian
experimental and did not appear in any release. For Stanford users, no
version of WebLogin with this vulnerability was ever deployed in
production.", would it make sense nevertheless to assign a CVE to this
issue?

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.