Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 27 Jul 2013 01:06:26 -0600
From: Kurt Seifried <>
CC: Forest Monsen <>,
        "" <>
Subject: Re: CVE request for a Drupal contributed module

Hash: SHA1

On 07/22/2013 12:22 PM, Forest Monsen wrote:
> Hi Kurt, regarding CVE assignment and your request for
> clarification at 
> On Wed, May 15, 2013 at 6:41 PM, Kurt Seifried
> <> wrote:
>> This sounds like two separate issues:
> [...]
>> can you send me the code patches fixing this so I can make sure
>> it gets the correct SPLIT/MERGE treatment? Thanks.
> Yep - Diffs for the commits that fixed both of these issues are
> at:
> Drupal 6:
> Drupal 7:
> For the first issue,
>> Accidental removal of account configuration.
>> In certain scenarios, Google Authenticator login incorrectly 
>> determines the user's account name. The change in account name
>> could cause the two-factor authentication for existing accounts
>> to be lost, allowing users to log in using just username and
>> password.
>> This vulnerability is mitigated by the fact while Google
>> Authenticator login's additional verification is by-passed, a
>> username and password are still required to log in.
> It looks like the maintainer now concatenates a "Realm" (site name)
> and suffix with the Drupal username to form the GA username. Any
> inconsistency there will invalidate earlier credentials.

Please use CVE-2013-4177 for this issue.

> For the second,
> One Time Password (OTP) replay
>> If an attacker can intercept a login request with a username,
>> password and OTP, an attacker could use this same data again to
>> login to the website.
>> This vulnerability is mitigated by the fact that an attacker who
>> can intercept a login request with this level of detail can
>> usually also intercept the ongoing session identifying token.
> It looks to me like the maintainer now implements a skew value to
> either (in the case of a time-based one-time password token) review
> only a certain range of timed tokens on either side, or (in the
> case of an HMAC-based one-time password token) to again test a
> range of tokens.
> I'll copy the Drupal Security Team, in case I haven't understood
> it correctly or if further clarification is necessary. Thanks.

Please use CVE-2013-4178 for this issue.

> Best, Forest

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1.4.13 (GNU/Linux)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.