[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5194394C.3060901@redhat.com>
Date: Wed, 15 May 2013 19:41:32 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Forest Monsen <forest.monsen@...il.com>
Subject: Re: CVE request for a Drupal contributed module
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/15/2013 01:16 PM, Forest Monsen wrote:
> Hi there,
>
> I'd like to request a CVE identifier for an issue in a contributed
> module:
>
> SA-CONTRIB-2013-047 - Google Authenticator login - Access Bypass
> https://drupal.org/node/1995706
>
> Thanks!
>
> Forest
This sounds like two separate issues:
Accidental removal of account configuration.
In certain scenarios, Google Authenticator login incorrectly
determines the user's account name. The change in account name could
cause the two-factor authentication for existing accounts to be lost,
allowing users to log in using just username and password.
This vulnerability is mitigated by the fact while Google Authenticator
login's additional verification is by-passed, a username and password
are still required to log in.
One Time Password (OTP) replay
If an attacker can intercept a login request with a username, password
and OTP, an attacker could use this same data again to login to the
website.
This vulnerability is mitigated by the fact that an attacker who can
intercept a login request with this level of detail can usually also
intercept the ongoing session identifying token.
can you send me the code patches fixing this so I can make sure it
gets the correct SPLIT/MERGE treatment? Thanks.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRlDlMAAoJEBYNRVNeJnmToZwP/1P6vCp4MIxHapkAo0QeQTLN
/kECmFiS/BZD6V0bDoZNLqkhcFRjtNhDlyXhpsqph05lD1zLqTyV8jktDETO8Rym
iRw7QRzWKpTIxV1EpcZ1WeivLWFB32xbwE3oI4bHuzwlu2pawrxGR16RT4+imsFC
UW+9Ld9uC8XuT1++IILKp3Ml874SmfNIiD9gW33qBSeJMKBri068i5UQ6zqZuCMi
zS91SJxYo7018eI9TyqAtGeqB0cpkOqNPcDEerWo/dxfute7/d8tdB4ShGniVXUq
nw0aodDuwDftGqKp9fH1MNOJ1e4wfoqc54zGcmD/vLouPYJumAa5ugMaG5RsIkVN
lBsPvTG9NJlukerNOnMwEd+D+Dut/0NUBkJZxK0KFUblGH6Goxaw2kUfbFIqhNDL
g8jX4EWSBLfNhgg8oUXiZkDBGLyKIv/Hum5tavQwnwtd6c/DZ/ey87phkD/2H375
slyHXxtmMHqbYMU90B9WjRVNc+R3uEtQhycvvA0qI0qS4z687pBjaCqqknxgX57n
3D8d8JdWC7PaU2m9P0m6uk4M/FEJqQG8VCsBHHfTJUq9fCKeyuhPFQgPbLpGv3Qi
RRTszagI1cQC5+pRDhZg9R2JStMe5TOO1WIfk9L7AMfOm56KFmQLS3n7O0mzczDD
iKM9mASPzBJxap18rwD7
=l4Tt
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
